Data Protection Authority of Bavaria
for the Private Sector
Data Protection Authority of Bavaria
for the Private Sector
Promenade 18 | 91522 Ansbach
Phone: 0981 180093 0
Fax: 0981 180093 800 postposte
E-mail: www.lda.bayern.de
Web:
29.08.2023
Final Decision for VMN 490333
Decision:
The Data Protection Authority of Bavaria for the Private Sector notes that has infringed Article
12(3) of the GDPR by not reacting immediately to the complainant’s request for deletion pursuant to Article 17
of the GDPR of 29.9.2022.
The Data Protection Authority of Bavaria for the Private Sector warns in accordance with Article
58(2)(b) GDPR for breach of Article 12(3) of the GDPR.
Summary of the case:
As part of the cooperation between the European data protection supervisory authorities, the Data Protection
Authority of Bavaria for the Private Sector has received the complaint of 2 November 2022, in accordance with
the provisions of Article 60 of the GDPR, as the lead data protection supervisory authority (Article 56(1) of the
GDPR), in which it was necessary to examine whether infringed the right to erasure of the com-
plainant.
The forwarding took place on 6.2.2023 by the Spanish data protection supervisory authority to which the com-
plainant had lodged his complaint.
Case of complaint:
The complainant indicated that he had submitted a request for deletion to the controller on 29 September 2022.
On 29.9.2022, the company’s external data protection officer informed the complainant that his application had
been forwarded to . A further reaction of the data protection officer or the controller then no
Side 1 of 3
longer took place.
of the controller:
The Data Protection Authority of Bavaria for the Private Sector requested a written opinion on the facts from the
controller on 20 April 2023. This statement of the insolvency administrator of the company of 27.4.2023 states
the following:
‘...It is true that, by order of 30.1.2023, the Amtsgericht München appointed Mr. Attorney . as insolvency ad-
ministrator. We assume that the processing of Mr ’s personal data was based on an online order for the goods
marketed by . ’s business operations are now completely discontinued. We do not know
whether the deletion request has reached in the past. In any case, the data and information provided
to us do not reveal any more information about a Mr. ....»
Statement of reasons for the decision:
In accordance with Article 17(1) of the GDPR, the data subject has the right to request the controller to delete
personal data concerning him or her without undue delay, and the controller is obliged to delete the personal
data without undue delay if one of the conditions set out in this Article is met, such as when the data is no
longer necessary for the purposes for which they were collected or the consent to the processing is revoked by
the data subject.
In accordance with Article 12(3) of the GDPR, the controller shall provide the data subject with information on
the measures taken on request pursuant to Articles 15 to 22 without undue delay and in any event no later than
one month after receipt of the request. This period may be extended by a further two months if necessary, tak-
ing into account the complexity and number of applications. The controller shall inform the data subject of an
extension within one month of receipt of the request, together with the reasons for the delay.
The complainant’s request for deletion pursuant to Art. 17 GDPR dated 29.9.2022 has been demonstrably re-
ceived by the data protection officer of the controller. The corresponding confirmation of receipt is available.
The exact date on which the complainant’s personal data were deleted cannot be seen in the statement of
27.4.2023, obviously the insolvency administrator is not aware of this. However, the opinion confirms that the
complainant’s personal data could no longer be found, so it can be assumed that the erasure request has been
implemented by the controller.
Regardless of the date of deletion, the controller failed to inform the complainant within one month of the
measures taken on the basis of his request, i.e. about the execution of the deletion, to which he would have
been obliged under Article 12(3) of the GDPR. This constitutes a violation of Article 12(3) of the GDPR.
Choice of supervisory measure:
It follows from Article 58(2)(i) and Article 83(2) GDPR that the data protection supervisory authorities are em-
powered to impose fines. According to the second sentence of recital 148, a warning may be issued in accord-
ance with Article 58(2)(b) in the case of a minor infringement instead of a fine. The aggravating and mitigating
circumstances of the case, such as the nature, gravity and duration of the infringement and previous, relevant
infringements, must be taken into account.
Side 2 of 3
Since the complainant's personal data has been deleted in the meantime and the Data Protection Authority of
Bavaria for the Private Sector, as the lead data protection supervisory authority for this company, has not re-
ceived any further complaints in connection with the data subject rights under the GDPR against this company
in the past, the issuance of a warning pursuant to Article 58 (2) (b) of the GDPR is deemed sufficient in the pre-
sent case.
Possibility of bringing proceedings:
With reference to Articles 77 and 78 of the GDPR, we would like to point out that this decision
may be brought against:
Verwaltungsgericht Ansbach in 91522 Ansbach,
House address: Promenade 24 – 28, 91522 Ansbach
Postal address: PO Box 616, 91511 Ansbach
Information on the possibility of bringing proceedings:
The appeal may be lodged in writing, for minutes or electronically in a form authorised to substi-
tute the written form. The filing of an appeal by simple e-mail is not allowed and has no legal
effects!
Yours sincerely
Data Protection Authority of Bavaria for the Private Sector
Side 3 of 3