3 November 2023
J.No. 2023-7320-0185
Doc.no. 506264
Caseworker
Complaint regarding Pluus.se
The Danish Data
Protection Agency
The Danish Data Protection Agency (DPA) hereby returns to the case in which Carl Jacobsens Vej 35
(hereinafter referred to as ‘the complainant’) lodged a complaint with the Swedish Authority for 2500 Valby
Denmark
Privacy Protection (IMY) stating that Pluus.se (owned by Group Buy ApS) did not comply with
T 3319 3200
his request for erasure. [email protected]
datatilsynet.dk
Pursuant to Article 56 of the General Data Protection Regulation, the Swedish Authority for VAT No. 11883729
Privacy Protection forwarded the complaint to the Danish DPA, which has the assumed role
of leading supervisory authority in relation to Group Buy ApS’ cross-border processing activit-
ies.
1. Decision
Following an examination of the case, the Danish DPA finds no grounds for concluding that
Group Buy ApS has acted in violation of Article 17 of the General Data Protection Regulation.
The details of the case and the reasons for the decision of the Danish DPA are set out below.
2. Statement of the facts
It appears from the complaint that the complainant by mistake subscribed to Pluus.se and then
received an invoice saying that he had to pay for a membership. On September 18th 2020 the
complainant asked Pluus.se to remove him from their database. The complainant later re-
ceived confirmation that Pluus.se had removed him as a costumer.
A year later, Pluus.se charged the complainant again. He then contacted the company attach-
ing a copy of the confirmation of erasure from 2020. Pluus.se answered by explaining their
business plan and thanked him for his order, even though he did not order anything.
On February 15th 2023 the Danish DPA asked Group Buy ApS for a statement, including
whether Group Buy ApS had received the complainant’s request for erasure, when the request
was received, and whether Group Buy ApS intended comply with the request.
On March 14th 2023 Group Buy ApS confirmed that the company did comply with the first
request of erasure in 2020. However, on October 18th 2021 the complainant made a new pur-
chase on the website and were, as a result, charged for a membership again in October and
November 2021. Attached was a copy of the receipt of payment.
On June 15th 2023 the Swedish Authority for Privacy Protection (IMY) forwarded the statement Page 2 of 3
of Group Buy ApS to the complainant on behalf of the Danish DPA, giving the complainant
four weeks to respond.
The Danish DPA did not receive any comments from the complainant in this regard.
3. Justification for the decision of the Danish DPA
3.1. According to Article 17 in the General Data Protection Regulation the data subject shall
have the right to obtain from the controller the erasure of personal data concerning him or her
without undue delay and the controller shall have the obligation to erase personal data without
undue delay where one of the following grounds applies:
a) the personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to
point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal
ground for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no
overriding legitimate grounds for the processing, or the data subject objects to the
processing pursuant to Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or
Member State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society
services referred to in Article 8(1).
According to article 17(3), paragraph 1 shall not apply to the extent that processing is neces-
sary:
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing by Union or Member
State law to which the controller is subject or for the performance of a task carried out
in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with points (h)
and (i) of Article 9(2) as well as Article 9(3);
d) for archiving purposes in the public interest, scientific or historical research purposes
or statistical purposes in accordance with Article 89(1) in so far as the right referred
to in paragraph 1 is likely to render impossible or seriously impair the achievement of
the objectives of that processing; or
e) for the establishment, exercise or defence of legal claims.
3.2. After examining the case, the Danish DPA finds no basis to set aside the information
provided by Group Buy ApS that the company complied with the complainant’s first request
for erasure.
The Danish DPA has emphasized what Group Buy ApS has stated regarding the complain-
ant’s second purchase on October 18th 2021 and thus the re-submission of personal data.
The Danish DPA has further placed emphasis that Group Buy ApS has complied with the
complainant’s second request for erasure and, as a result, Group Buy ApS does not process
any other information about the complainant than the company is obligated to by law.
4. The Danish DPA hereby considers the case to be closed. Page 3 of 3
This decision cannot be brought before any other administrative authority, cf. Section 30 of the
Data Protection Act1. However, the decisions of the Danish Data Protection Agency may be
brought before the courts, cf. section 63 of the Danish Constitution.
Kind regards
1 Act No. 502 of 23 May 2018 on supplementary provisions to the regulation on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data (the Data Protection Act).