Trustpilot A/S
4 July 2023
Pilestræde 58, 5.
1112 København K J.No. 2022-7320-3511
Danmark Doc.no. 614464
Caseworker
Sent via Digital Post
Complaint about Trustpilot A/S
The Danish Data
Protection Agency
1. The Danish Data Protection Agency (hereinafter referred to as ‘the Danish DPA’) hereby Carl Jacobsens Vej 35
returns to the case, where on 30 November 2021 complained to the Irish Data 2500 Valby
Denmark
Protection Commission about the processing of personal data.
T 3319 3200
dt@data ilsynet.dk
In accordance with Article 56 of the GDPR1, the Danish DPA has been designated as the lead datatilsynet.dk
supervisory authority in the case. VAT No. 11883729
2. Decision
After examining the case the Danish DPA that Trustpilot A/S’ processing of
request for erasure has not been carried out in accordance with GDPR Article 12(3), cf. Article
17. The Danish DPA therefore issues a reprimand.
The reasons for the Danish DPA’s decision are set out below.
3. Facts of the case
The Danish DPA understands the case as a complaint regarding Trustpilot A/S not accom-
modating the complainant’s request for erasure, cf. GDPR article 12 and 17.
On 12 September 2021 contacted Trustpilot A/S regarding two reviews, which
he found to be incorrect and libelous. requested to have these reviews removed.
Furthermore, he referenced a Google search result where part of one of these reviews stating
“Blue Dolphin House B&B is run by a fraudster” was visible.
On 27 September 2021 filed a complaint with the Irish Data Protection Commis-
sion stating that he had yet to hear from Trustpilot A/S regarding his request for erasure.
As the lead supervisory authority in relation to Trustpilot A/S, the Danish Data Protection
Agency subsequently took over the case from the Irish supervisory authority, after which on 6
July 2022 the Danish Data Protection Agency sent complaint to Trustpilot and
asked Trustpilot for a statement.
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protec ion of natural per-
sons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation).
Trustpilot A/S issued a statement on the matter on 8 August 2022. The statement was sent to Page 2 of 2
on 6 October 2022. According to this statement, Trustpilot A/S responded to
request for erasure on 31 December 2021 with the following:
“Hi ,
Thanks for your email and our sincerest apologies for the delay in response. We're
happy to address your concerns. However, we do recommend flagging reviews dir-
ectly through your Trustpilot Business account, as this automatically triggers our in-
vestigation process and helps us get all the information we need to handle your re-
quest. Every business can claim their Trustpilot profile and create a business account
for free. Here’s some more info to get you started: …”
In this statement, Trustpilot A/S also specified that the reviews in question were no longer
visible on the Trustpilot website.
On the 10 October 2022 provided his comments to Trustpilot A/S’ statement,
in which stated that he did not consider the matter closed since the reviews
in question were still visible via a Google search.
4. The Danish DPA’s assessment
According to Article 17 of the GDPR the data subject has the right to obtain from the controller
the erasure of personal data concerning him or her without undue delay and the controller shall
have the obligation to erase personal data without undue delay where one of the grounds in
Article 17(1)(a-f) is applicable.
Article 12(3) of the GDPR states that a right request, such as a request for erasure, must be
answered without undue delay and in any case within one month of receipt of the request. It
also states that the controller shall inform the data subject of any extension within one month
of receipt of the request, together with the reasons for the delay.
Based on the information in the case, the Danish DPA finds that Trustpilot did not respond to
request for erasure in accordance with article 12(3) of the GDPR.
After examining the case the Danish DPA that Trustpilot A/S’ processing of
request for erasure has not been carried out in accordance with GDPR Article 12(3), cf. Article
17. The Danish DPA therefore issues a reprimand.
The Danish DPA is not competent in regards to complaints regarding his re-
quest to erasure of the Google search results. The DPA recommends contact
Google in this matter.
5. Final remarks
The Danish Data Protection Agency notes that the supervisory authority’s decisions cannot
be brought before another administrative authority, cf. Section 30 of the Danish Data Protec-
tion Act. However, the Data Protection Agency’s decisions may be brought before the courts,
cf. section 63 of the Danish Constitution.
Kind regards