THE COMMISSIONER FOR DATA PROTECTION AND FREEDOM OF INFORMATION
LfDI Baden-Württemberg · P.O. Box 10 29 32 ·D-70025 Stuttgart
File No. R 2482/249
[…]
Supervisory data protection investigation in accordance with Article
57(1)(a), (f) and Article 58(1)(b) GDPR
– Your Ref. no. […]
Your letter of 28 June 2021
Dear Madam or Sir,
Having examined the facts of the case we get back to you regarding the
complaint under the above-mentioned Ref. no.
I. The course of the procedure
The Baden-Wuerttemberg DPA (hereinafter: BW DPA) launched an
investigation based on the complaint of (hereinafter: the
Complainant) pursuant to Article 57(1)(f) of the General Data Protection
Regulation (hereinafter: GDPR).
In July 2018, the Complainant lodged a complaint with the Data Protection
Authority of Austria, in which he presented that he had exercised his right of
access as per Article 15 GDPR to ,
(hereinafter: Controller). According to his allegations, he has
received no response within a month.
The Austrian DPA submitted the complaint to our DPA (DE/BW) in August
2018 via an Article 56 procedure in IMI (no. 48007). The DE/BW DPA agreed
to handle the case as LSA and created a case register in IMI (no. 71144).
After concluding the investigations, the draft decision was shared preliminary
with the CSAs in A60IC 429634. Only the AT DPA raised some questions
which we could answer to their full satisfaction (61VMN 507475). We did not
receive comments from one of the other CSAs.
1
Subsequently, the draft decision was formally shared as per Article 60(3)
GDPR with the CSAs in A60DD 507994. There were no comments or
objections raised to the draft by any of the CSAs.
II. Facts of the case
The complainant states that he had sent an access request to the controller on
3 June 2018 via the website contact form ). Even though the
receipt had been confirmed, the request had not been dealt with within one
month. He claims that by the time the complaint was filed, he had received no
response.
The DE/BW DPA contacted the Controller in order to ask them for a response
to the facts the complainant presented. We also forwarded the access request
to the Controller, which the complainant had enclosed to the complaint. There
was an exchange of different correspondence with the Controller in the
following months.
On 29 June 2021, a law firm informed the DE/BW DPA that they would legally
represent the Controller in the proceeding. They submitted a comprehensive
statement regarding the complainant’s allegations in which they state that the
accusation that their client would not have answered the access request of the
complainant is not true, but that, based on the data protection regulations in
force at the time, the information request was fully answered by letter of 13
July 2018. However, after such a long time, ascertaining that the complainant
received the letter, would no longer be possible due to the fact that certificates
of delivery held by the German post office are only valid for one year. The
letter sent to the complainant on 13 July 2018 does not show a date of receipt.
They also state that in 2018 it was standard practice of their client to always
grant such access requests by mail.
The client was therefore surprised to learn from the correspondence that the
complainant did not receive the information letter. They immediately provided
the requested information and sent it to the Complainant again on 28 June
2021, together with evidence about the respective business relationship as
regards the purchases made by the complainant, in accordance with the
applicable processes currently in force.
III. The findings of the Authority
Pursuant to Article 12(1) GDPR, the controller shall take appropriate measures
to provide any information referred to in Articles 13 and 14 and any
communication under Articles 15 to 22 and 34 relating to processing to the
data subject in a concise, transparent, intelligible and easily accessible form,
using clear and plain language. According to Article 12(3) GDPR, the
controller shall provide information on action taken on a request under Articles
15 to 22 to the data subject without undue delay and in any event within one
2
month of receipt of the request, whereby that period may be extended by two
further months where necessary, taking into account the complexity and
number of the requests.
Based on the statement and documents submitted by the Controller, it is
evident for the DE/BW DPA that they have complied with the complainant’s
access request as per Article 15 GDPR already on 13 July 2018, as the copy
of the letter sent to the complainant is still in the possession of the Controller
and shows this date. The fact that the postal receipt is no longer valid is not a
fact the controller could have any influence on. At the latest, the information
has been delivered to the complainant subsequently after the DE/BW DPA
conducted the investigation.
Nevertheless, also sending the information to the complainant already on 13
July 2018 would have been outside of the one-month deadline of receipt of the
request as per Article 12(3) GDPR.
It is not apparent that the Company was in a situation of Article 12(2) or (3)
GDPR. Firstly, the Company was able to identify the Complainant, meaning
that there was no reason for asking for further identification of the
Complainant. Secondly, the Company has not indicated that they process
such a wide scope and large number of data so as to request the Complainant
to specify his request.
Additionally, the Controller did not inform the data subject within a month
about not taking action on the request together with reasons for not taking
action as requested by Article 12(4) GDPR.
By not having reacted to the Complainant's access request without undue
delay, they have infringed Article 15(1) as well as Article 12(1) and (3)
GDPR.
IV. Legal consequences
The DE/BW DPA establishes that the Company breached Article 15(1) as well
as Article 12(1) and (3) of the GDPR, as the Complainant's access request
has not been dealt with in due time.
However, due to the constellation explained, the controller was in the situation
to validly believe to have answered the access request of the complainant.
They apologised for this mistake and immediately provided the requested
information to the Complainant (again).
In addition, the Company has been very cooperative during the regulatory and
supervising process. Following the investigation of the DE/BW DPA, the
Controller immediately gave the requested information.
Hence, the BW DPA issues a reprimand to the company for the
abovementioned infringements of the GDPR, based on Article 58(2)(b) GDPR.
3
We will also reiterate to the Controller again the fact that requests under
Articles 15-22 GDPR must be answered without undue delay, at the latest
within one month, and that the Controller must implement internal processes
that ensure a response within this deadline.
V. Information on legal remedies
An appeal against this decision may be filed in writing, electronically or for
recording with the Administrative Court of Stuttgart, Augustenstraße 5, 70178
Stuttgart, within one month of notification pursuant to Article 78 of the General
Data Protection Regulation in conjunction with Section 20(1) and (3) of the
Federal Data Protection Act.
4