of the deletion of the complainant’s personal data and a copy of the information
given to the complainant, including proof of the complainant’s receipt of this infor-
mation,
4. With regard to paragraphs 2 and 3 above, the SDPTC orders the immediate
execution of these orders.
5. In the event that you fail to comply with these obligations according to para-
graph 2 above within a period of two weeks of the service of this order, or, in case of
the restoration of the suspensive effect of a legal remedy, within two weeks of the
non-contestability of this decision, I intend to impose a coercive penalty payment of
2.500 €.
6. In the event that you fail to comply completely or partially with the obliga-
tions according to paragraph 3 above for each information not given or not given
completely I intend to impose a coercive penalty payment of 1.000 €.
7. Costs (fees and expenses) are not charged.
Grounds for the decision:
I.
(1) You operate the website www. . The was a net-
work through which members of the club offered each other free overnight stays and as-
sistance in their travels. To use the network it was necessary to register on the website
with the first and last name, the postal address and a valid e-mail address. Members were
able to communicate with each other via personalised accounts.
Page 2 of 16
(2) The complainant requested you, the operator of this website, to delete his/her per-
sonal data (first and last name, birthday, address, registered address, photo) on 27 No-
vember 2018 and on 20 January 2019. He sent these requests by e-mail, in the absence of
information about a data protection officer on the website, to http:/
and to (deleted)@ You did not answer this request for de-
letion and the personal data could be found at http:/
.
(3) The complainant then lodged a complaint with the polish data protection supervi-
sory authority on 2 March 2019. With his letters of 26 June 2019 and 11 July 2019, The
complainant contacted the Polish supervisory authority again and requested the deletion
of his personal data and informed it, that they were still available at http://
. The case was referred to the
SDPTC in her capacity as the lead supervisory authority with an Art. 56 GDPR-procedure
(IMI-No. 124734)
(4) By letter dated 18 February 2021 with the ref.: 2-3505/29/1, the Saxon Data Pro-
tection and Transparency Commissioner informed you of the complaint of the complain-
ant and gave you the opportunity to be heard. You did not respond to this letter. You were
then obliged to provide information by means of a notice of mandatory participation dated
9 March 2022, served 10 March 2022. You have not provided this information.
(5) On 9 September 2022, the Saxon Data Protection and Transparency Commissioner
found that it was no longer possible to view or access the website www
(6) By letter of 20 September 2022, you were informed of the infringement of the data
subject’s rights, i.e. that you did not to take action on the complainant’s erasure request
and failed to provide such information (hearing pursuant to § 28 I German Administrative
Procedure Act – Verwaltungsverfahrensgesetz, VwVfG). You have been informed, that
failure to take action on a erasure request constitutes an infringement of Art. 17 I GDPR.
Page 3 of 16
You were also informed that not informing the complainant of the measures taken or not
taken within a month after receipt of the deletion request infringes Art. 12 III GDPR. You
have been informed that due to these violations of data protection law, to issue a formal
reprimand was considered.
You have also been informed that a formal order is intended to comply with the complain-
ant’s request to delete his personal data and to provide information on the measures taken.
You have also been informed of the intention to issue a formal order requiring you to
prove to the SDPTC compliance with the data subject’s requests to exercise his or her
rights pursuant to this Regulation.
You were informed that the imposition of a coercive penalty payment is intended if you
do not comply with these orders.
You were given the opportunity to be heard on this subject until October 7, 2022. You did
not respond.
II.
The Saxon Data Protection and Transparency Commissioner is the competent supervi-
sory authority for the non-public area within the scope of the General Data Protection
Regulation and the first two parts of the German Federal Data Protection Act (Bun-
desdatenschutzgesetz BDSG), Article 51 I of the General Data Protection Regulation
(GDPR) in conjunction with Section 14 I Saxon Data Protection Implementation Act
(Sächsisches Datenschutzdurchführungsgesetz-SächsDSDG) and § 40 I of the German
Federal Data Protection Act (Bundesdatenschutzgesetz-BDSG) in conjunction with § 14
II SächsDSDG. As the operator of the website www. you are the controller
(Art. 4 No. 7 GDPR) and you are a non-public body (§ 2 IV BDSG), so the Saxon Data
Protection and Transparency Commissioner is the competent supervisory authority.
The registration on the website www using the first and last name,
address and e-mail address, and the optional creation of a profile in the member account
Page 4 of 16
these data were available at http:/
Against Art. 17 I, you did not delete them without undue delay. The
deletion has to take place without undue delay, this means promptly. In this respect the
period of Art. 12 IV GDPR (one month) is not applicable. However, the data were still
available for at least a period of more than five months; so you did not delete them without
undue delay
As a result, the personal data of the complainant were not deleted without undue delay, in
any event, within a month after receipt of the request.
Art. 17 III GDPR does not forbid deletion in the present case.
According to this, the controller is not obliged to delete insofar as the processing is nec-
essary to exercise the right to freedom of expression and information (Art. 17 III a GDPR);
to comply with a legal obligation which requires processing by Union or Member State
law legal obligation which requires processing to which the controller is subject, or for
the performance of a task carried out in the public interest or in the exercise of official
authority vested in the controller (Art. 17 III b GDPR); for reasons of public interest in
the area of public health pursuant to Art. 9 II h, i and Article 9 III (Article 17 III c GDPR);
d. for archiving purposes in the public interest, scientific or historical research purposes
or statistical purposes in accordance with Article 89 I, in so far as the right referred to in
paragraph 1 is likely to render impossible or seriously impair the achievement of the ob-
jectives of that processing (art. 17 III d GDPR), or for the establishment, exercise or de-
fence of legal claims (Article 17 III e GDPR).
You did not present the supervisory authority with facts to conclude, that this case might
be covered by of one of the execptions of 17 III GDPR in the hearing. We therefore
assume, that in this case there is no exception under Article 17 III of the GDPR.
Consequently, you were obliged to delete the personal data of the complainant without
undue delay according to Art. 17 I GDPR.
It must therefore be concluded that you had an obligation to immediately erase the com-
plainant’s personal data and failed to comply with that obligation. Thus, you have violated
Art. 17 I GDPR.
Page 7 of 16
3. The admissibility of the processing of personal data requires a legal basis, other-
wise the controller infringes the principle of the lawfulness of data processing pursuant to
Art. 5 I a GDPR. After the complainant withdrew his consent, you have processed his
personal data without a legal basis (see point 2)
In doing so, you have violated the principle of lawfulness of data processing pursuant to
Art. 5 I a GDPR.
In accordance with recital 39 of the GDPR, the principle of transparency requires that any
information and communication relating to the processing of those personal data be easily
accessible and easy to understand, and that clear and plain language is used. That principle
concerns, in particular, information of the data subjects on the identity of the controller
and the purposes of the processing and further information to ensure fair and transparent
processing in respect of the natural persons concerned and their right to obtain confirma-
tion and communication of their personal data which are being processed.
By not complying with the erasure request (see point 2 above) and not informing the data
subject (see point 4 below), you have left the data subject in the dark about further data
processing, contrary to Article 5 I a GDPR, and thus did not assure the transparency of
the processing.
4. The controller shall provide information on action taken on a request under Art.
15 to Art. 22 to the data subject without undue delay and in any event within one month
of receipt of the request, Art. 12 III 1 GDPR.
That period may be extended by two further months where necessary, taking into account
the complexity and number of the requests. The controller shall inform the data subject of
any such extension within one month of receipt of the request, together with the reasons
for the delay, Art. 12 III 3 GDPR.
You, the controller,have not informed the complainant immediately or within one month
of receipt of his erasure request on actions taken, for example about the deletion. You also
did not notify the complainant within one month of receipt of the request for erasure of
reasons to deny erasure according to Article 17 III GDPR.
Page 8 of 16
Nor did you inform him, within one month of receipt of the erasure request, of an exten-
sion of the information period according to Art. 12 III 2 GDPR, including the reasons for
the delay.
Thus, you have violated your obligations under Art. 12 III GDPR.
5. The supervisory authority’s task is to monitor and enforce the application of the
provisions of data protection law (Art. 57 I a GDPR, § 40 I BDSG). This includes, in
particular, Art. 5, 17 and 12 GDPR (lawfulness of the processing of personal data; erasure
of personal data and information regarding the exercise of data subject’s rights). In addi-
tion to investigative powers, the Saxon Data Protection and Transparency Commissioner
also has corrective powers. Pursuant to Article 58 II GDPR, the supervisory authority has
administrative discretion whether to exercise its supervisory powers and how to exercise
them. Pursuant to Article 58 II GDPR, it may exercise its corrective powers if it has found
or at least expects a breach of data protection regulations. In such cases, the authority has
discretion concerning the legal consequences. In its exercise, it must, in particular, adhere
to the principle of proportionality. In the case of proven infringements, the supervisory
authority is usually obliged to take action against them with the aim of putting an end to
the data protection breach. With regard to the discretion whether to exercise its supervi-
sory powers, this discretion is intended to be narrowed down by the lawmaker, if, as in
the present case, there is a (grave) infringement. With regard to the discretion how to
exercise these supervisory powers, in choosing the appropriate corrective power under
Art. 58 II GDPR, the principle of proportionality must be adhered to and, in this respect,
also the intensity of the intervention ordered must be taken into account.
5.1 Pursuant to Art. 58 II b GDPR, the supervisory authority can issue reprimands to
a controller or a processor where processing operations have infringed provisions of the
GDPR. The reprimands are intended to show the controller that the processing does not
comply with the provisions of the GDPR. According to the wording of the provision, a
reprimand can be imposed not only instead of, but also in addition to a fine, Art. 58 II
GDPR The reprimand formally disapproves of the action (or inaction) of the controller,
Page 9 of 16
which can also be taken into account in a procedure to impose a fine pursuant to Article
83 II i GDPR.
You have violated Art. 17 I GDPR (see point II. 2.), Art. 5 I a GDPR (see point II.3.) and
Art. 12 III GDPR (see point II.4.).
In the event of a breach of data protection law, it is at the discretion of the supervisory
authority whether to issue a reprimand. The reprimand issued under paragraph 1 of this
order corresponds to the infringements referred to in point II. 2 to II.4 as a correct exercise
of administrative discretion.
The reprimand in paragraph 1 gives due regard to the principle of proportionality. The
reprimand is also able to induce the controller to comply with data protection regulations
in the future, in particular those protecting the rights of the data subject (Art. 57 I a
GDPR).
It is also necessary because there are no equal means to achieve the goal. In particular, a
warning pursuant to Art. 58 II a GDPR is not appropriate in the present case, since it is a
preventive measure. In the present case, however, the controller has already violated the
GDPR, so that a warning is no longer possible. From the point of view of the Saxon Data
Protection and Transparency Commissioner, the reprimand is the mildest measure from
the catalogue of Art. 58 II GDPR to show the controller the violations of the GDPR, in
particular the infringement of the data subject’s rights, and to persuade him to process
personal data lawfully. In particular with regard to the repeated erasure requests by the
data subject and several letters from the supervisory authority, to which the controller did
not react except by closing the website, the Saxon Data Protection and Transparency
Commissioner can assume that the reprimand will lead to the termination of these viola-
tions of the GDPR and will bring processing operations into compliance, in particular to
respect the data subject’s rights. The reprimand is therefore appropriate.
5.2 Art. 58 II c GDPR allows the supervisory authority to order the controller to com-
ply with the data subject’s requests to exercise his or her rights pursuant to this GDPR.
The order to comply with the request of the data subject (deletion of personal data and to
inform him about it) fulfils the requirements of a correct exercise of administrative dis-
cretion. Deletion is the irrevocable removal of a reference to a person and of information,
Page 10 of 16
that enables others to make the connection with a person. Stored electronic data must be
destroyed completely and irrevocably. Physical data media (e.g. printouts) shall be de-
stroyed by means appropriate to their nature and level of confidentiality.
The order enforces the application of the GDPR (Art. 57 I a GDPR), in particular of data
subjects’ rights. It is also necessary. Equally effective milder measures to achieve this
objective are not available in this case. There are no investigative and corrective measures
from the catalogue of Art. 58 II GDPR, which constitute a less invasive alternative, from
the point of view of the controller, with which the goal of achieving data protection law
compliance could be accomplished. A notice (Art. 58 I d GDPR) or a warning (Art. 58 II
a GDPR) are not effective for achieving this goal in this case, in particular with regard to
the opportunity to be heard (letter of 18 February 2021, the notice of mandatory partici-
pation of 9 March 2022, as well as the hearing by letter dated 20 September 2022) you
did not use to state your view and which also did not make you fulfil your obligations as
a controller in relation to data subjects’ rights. Instead, you have only prevented access
to the website without, however, providing information about the database or the deletion
of data or informing the data subject about this.
5.3 The legal basis for authorising the submission of evidence is Art. 58 I a GDPR
that allows any supervisory authority to order the controller to provide any information it
requires for the performance of its tasks. The order allows the supervisory authority to
effectively control its basic decision (paragraph 2 of the decision) to provide proof of the
deletion of the complainant’s personal data and to provide a copy of the information letter
to the complainant, including proof of receipt of this letter by him .
Administrative discretion is exercised correctly by giving this order. Only these proofs
enable the supervisory authority to effectively verify compliance with the order to delete
the personal data and to inform the data subject. There is also no milder, equally effective
measure in the catalogue of measures in Art. 58 I and II GDPR. As the controller, to
deliver proof does not imply any disproportionate effort or is an infringement of your
rights, in particular against the background, that the supervisory authorities have by law
to control effectively the implementation of the data protection regulations (Art. 57 I a
GDPR).
Page 11 of 16
6 The order for immediate execution is based on § 80 II 1 No. 4 of the German Code
of Administrative Court Procedure (Verwaltungsgerichtsordnung-VwGO). It states, that
the suspensive effect fails to be applied in cases where immediate execution is specifically
ordered in the public interest or in the overriding interest of a party concerned, by the
authority which adopted the administrative act. This means that an objection or a judicial
remedy against that order does not have suspensive effect.
The conditions laid down in § 80 II 1 No. 4 VwGO are met. There is a special “immediate
execution interest” beyond the “interest in the decision”, since the order for immediate
execution is in the public interest. This is based on continuous violation of the data sub-
ject’s rights in the form of the right to be forgotten and failure to inform the data subject
immediately or at the latest within a month, as well as the continued unlawful processing
of data and the resulting serious violation of the data subjects’ right to informational self-
determination (Art. 2 I, 1 I of the German Basic Law).
The data subject must be protected against the ongoing and present danger that you con-
tinue to process his or her personal data and therefore violate his interests and fundamental
rights or freedoms. In particular, users of your website or the members of the
trust you to process their personal data in accordance with the applicable data pro-
tection regulations. This trust is build up by the supervisory authority, which has the task
to monitor the compliance with data protection regulations, removes proven data malad-
ministration and thus ensures lawful data processing.
Because of your lack of cooperation in the supervisory procedure and the ongoing refusal
to comply with the data subject’s requests exercising their rights, further violations against
the General Data Protection Regulation or the continuation of unlawful data processing
are to be expected without the order of immediate execution. Accordingly, there is immi-
nent danger in delay. To be able to avoid compliance with data protection regulations for
an indefinite period of time by appealing against a decision would be contrary to the leg-
islative intention to further the public interest in an effective data protection supervisory
authority. Any further delay - solely due to proceedings - entails a significant risk that
unlawful processing and thus the violation of the personal rights of the persons concerned
in the form of the right to informational self-determination will continue indefinitely.
Page 12 of 16
It is therefore in a particular public interest not to wait for the non-contestability of the
orders under point 2 of this administrative order and to continue to accept a breach of the
General Data Protection Regulation. Otherwise, due to the suspensive effect of an objec-
tion, enforcement of the provisions of data protection and effective fundamental rights
protection would simply no longer be fulfilled (see, in particular, Saxony Higher Admin-
istrative Court Bautzen, order of 17 July 2013, ref. 3 B 470/12, published under: www.ju-
ris.de).
The order for immediate execution also respects the rules for the exercise of administra-
tive discretion (§ 40 of the German Administrative Procedure Act – Verwaltungsver-
fahrensgesetz, VwVfG)) In the balancing of the interest in immediate execution and your
opposing interest in the suspensive effect of an objection or an appeal, as well as to be
spared initially from enforcement measures, the enforcement interest (public interest) pre-
vails. In the specific case, the order for immediate enforcement of the obligation contained
in paragraph 2 of this decision shall exceptionally take precedence over waiting until its
non-contestability.
7. In order to force you to fulfil your obligations under paragraphs 2 to 3 of the order, a
penalty payment is threatened (§§ 2, 19 an 20 of the Saxonian Administrative Order En-
forcement Act – Sächsisches Verwaltungsvollstreckungsgesetz für den Freistaat Sach-
sen, SächsVwVG) The threat of penalty payments is based on § 19 in conjunction with
§ 20 SächsVwVG. According to § 19 SächsVwVG, administrative acts which impose
other acts, toleration or omission are enforced by enforcement measures.
The general conditions for enforcement laid down in § 2 SächsVwVG are fulfilled, since
immediate execution was separately ordered for the orders in question pursuant to § 80 I
Nr. 4 VwGO (enforcement order, § 2 No. 2 SächsVwVG). They are also enforceable ad-
ministrative acts (§ 1 of the Saxon Administrative Procedure and Administrative Service
Act, Gesetz zur Regelung des Verwaltungsverfahrens- und des Verwaltungszustellungs-
rechts für den Freistaat Sachsen – SächsVwVfZG) in conjunction with § 35 VwVfG.
The order threatening a penalty payment is issued in writing required by § 20 I 1
SächsVwVG and sets a reasonable time-limit (§ 20 I 2 SächsVwVG).
Page 13 of 16
The administrative discretion ordering a threat of a penalty payments is correctly exer-
cised. According to § 19 V SächsVwVG coercive means may be used repeatedly and until
the order to be enforced has been completed or is not necessary anymore. In the present
case, compliance with the order can only be effectively enforced by the threat of coercive
means, in particular with regard to the lack of cooperation on your part in the previous
administrative proceedings.
The Saxon Data Protection and Transparency Commissioner has made lawful use of its
administrative discretion in selecting this measure. With regard to the chosen coercive
measure, penalty payments should have the priority, The order threatening a penalty pay-
ment is suitable to urge you to comply with data protection regulations. The penalty pay-
ment is also the least invasive means of coercion from the catalogue of § 19 II
SächsVwVG. Other equivalent means of coercion to establish the rule of law are not
available (necessity, § 19 III SächsVwVG). In addition, the penalty payment is propor-
tionate to the purpose of ending the unlawful conditions and to bring about lawful condi-
tions, i.e. to verify compliance with the relevant orders by providing appropriate evidence
(§ 19 IV SächsVwVG).
The amount of the penalty payment is determined by § 20 IV und § 22 I SächsVwVG. In
doing so, the Saxon Data Protection and Transparency Commissioner has calculated the
amount of penalty payments, reflecting, in particular, the seriousness of the infringement
and the associated intervention into constitutionally protected legal positions of the per-
sons concerned (right to informational self-determination, Art. 2 I, 1 I GG).
In the event of non-compliance with the order referred to in paragraph 2 of this decision,
a coercive payment of EUR 2,500 is threatened. The continued processing of personal
data of the data subject and the infringement of the data subject’s rights (no deletion and
no information of the data subject) justifies the amount of the penalty payment. The issue
of this order is intended to make the controller respect the data subject’s rights under the
GDPR.
In contrast, the order giving evidence is of subordinate importance, which is reflected in
the comparatively lesser amount of the penalty payment.
Page 14 of 16
Overall, the threat of coercive payment is in accordance with the intention of the enforce-
ment law to persuade the person responsible to comply with an order in the long run. The
amount of the penalty payments threatened is likely to prompt you to fulfil your obliga-
tions.
Advice on legal remedies :
An action may be brought against that decision within one month of its notification. The
action must be brought before the Administrative Court of Dresden (Verwaltungsgericht
Dresden, Hans-Oster-Straße 4, 01099 Dresden) in written form or for the record of the
clerk of the court.
Information :
1) The Saxon Data Protection and Transparency Commissioner is a supreme state
authority in accordance with § 15 I SächsDSDG. This decision cannot therefore be re-
viewed in a preliminary administrative proceeding, but can only be appealed with an re-
scissory action brought before the Administrative Court of Dresden (§ 68 I VwGO) The
administrative court of is locally competent (§ 20 III BDSG).
2) Appeals against measures of administrative enforcement have no suspensive effect
and therefore do not release from the obligation to pay (§ 80 II 1 Nr. 4 VwGO in conjunc-
tion with § 11 I SächsVwVG). On request, the Dresden Adminstrative Court may restitute
the suspensory effect of the action in whole or in part (§ 80 V VwGO).
3) After the deadline set in this order, the penalty payment may be fixed (§ 22 II
SächsVwVG) if you have not complied with the orders listed under paragraph 2, 3 of this
decision.
4) Pursuant to Paragraph 19 V of the SächsVwVG, the order threatening coercive means
may be repeated, until you have fulfilled your obligations. The payment of a fixed penalty
Page 15 of 16
payment does not terminate your obligation to comply with the orders. However, the co-
ercive procedure is terminated as soon as you have complied with the orders under para-
graph 2, 2 of this decision (§ 2 a I Nr. 1 SächsVwVG)
5) Violations of the obligation to provide information to the supervisory authority, Art.
58 I a GDPR, the order to comply with the request of the data subject (Art. 58 II c GDPR)
may be punished as an administrative offence with a fine of up to EUR 20 000 000
(Art. 83 V e GDPR) irrespective of the enforcement of the penalty payment.
With kind regards
On behalf of the SDPTC
(name)
Desk Officer
Page 16 of 16