BAVARIAN STATE OFFICE FOR DATA PROTECTION SUPERVISION
Unofficial translation
Our reference number: LDA-1085.3-4314/20-I
Controller:
On the basis of the draft decision of the Luxembourg supervisory authority, the Bavarian State Office for
Data Protection Supervision (BayLDA) adopts pursuant to Article 60(8) GDPR the following:
Final decision:
The complaint is dismissed.
Justification:
The complaint was received by the BayLDA on 5.5.2020 and was forwarded via IMI to the Luxembourg
Supervisory Authority as the lead data protection supervisory authority of the controller.
On 5.12.2022, the Luxembourg supervisory authority submitted draft Decision No DD 462168 to the
supervisory authorities concerned, with the following content:
I. Facts and procedures
1. Within the framework of European cooperation pursuant to Chapter VII of Regulation
(EU) 2016/679 on the protection of natural persons with regard to the processing of
personal data, on the free movement of such data and repealing Directive 95/46/EC
(General Data Protection Regulation or GDPR), the Bavarian State Office for Data
Protection Supervision, the National Data Protection Commission (hereinafter: “the
CNPD”) the complaint by (national reference number of the authority
concerned: Lda-1085.3-4314/20-I) via the IMI procedure referred to in Article 61 –
180323.
2. The complaint was lodged against the controller
(‘ ’), which has its main establishment in Luxembourg. In accordance with Art.
56 GDPR, the CNPD is therefore the lead competent data protection supervisory
authority.
3. The original IMI application states:
“The complainant has submitted a request for information pursuant to Article 15 of the
GDPR, which has been rejected by reference to accessible data on the Internet. Even
after the request for further information had been clarified and formulated concretely,
the complainant’s request for further information was not adequately answered.
Subsequently, the complainant received data in various formats (including “ ”)
However, the complainant had not received a concrete and comprehensible response
to his request.”
4. Essentially, the applicant tried to submit a “product review” to regarding a
product purchased by him. He was then informed by that his product review
has been removed according to guidelines.
The complainant therefore asked to provide him with a copy of his personal
data and in particular requested to obtain the algorithm and the specific data
used to remove the product evaluation. The complainant did not receive the requested
information and therefore considers that did not properly reply to its request
for access.
5. The complaint is therefore based on Art. 15 GDPR.
6. On the basis of this complaint and in accordance with Article 57(1)(f) of the GDPR,
CNPD invited to comment on the facts the complainant had submitted and, in
particular, to provide a detailed description of the problem relating to the processing of
the complainant’s data, in particular with regard to his right of access and the reasons
why did not provide the complainant with the information requested by him.
7. The CNPD received the requested information within the deadlines set.
II. In law
1. Applicable legislation
8. Article 77 of the GDPR provides: ‘Without prejudice to any other administrative or
judicial remedy, any data subject shall have the right to lodge a complaint with a
supervisory authority, in particular in the Member State of his or her habitual residence,
place of work or place of the alleged infringement if the data subject considers that the
processing of personal data relating to him or her infringes this Regulation.’
9. Pursuant to Article 15(1) of the GDPR, the data subject has the right to obtain
confirmation from the controller as to whether or not he or she is processing personal
data and, if so, access to the personal data and the following information.
10. Article 15(3) of the GDPR provides: ‘The controller shall provide a copy of the personal
data in the processing. For any further copies requested by the data subject, the
controller may charge a reasonable fee based on administrative costs. Where the data
subject makes the request by electronic means, and unless otherwise requested by the
data subject, the information shall be provided in a commonly used electronic form.”
11. According to Article 15(4) of the GDPR, “the right to receive a copy in accordance with
paragraph 3 shall not affect the rights and freedoms of others.”
12. Article 56(1) of the GDPR provides: ‘The supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried
out by that controller or processor in accordance with the procedure provided in Article
60.’
13. In accordance with Article 60(1) of the GDPR, "the lead supervisory authority shall
cooperate with the other supervisory authorities concerned in accordance with this
Article in endeavour to reach consensus. The lead supervisory authority and the
supervisory authorities concerned shall exchange all relevant information with each
other.
14. In accordance with Art. 60 para. 3 GDPR: ‘The lead supervisory authority shall transmit
the relevant information to the other supervisory authorities concerned without delay. It
shall without delay submit a draft decision to the other supervisory authorities concerned
for comments and shall give due consideration to its views;
2. In the present case,
15. Following the intervention of the Luxembourg supervisory authority, confirmed:
• The non-acceptance of the product review by the applicant in this case (but also in the
case of product evaluation of other users) is based on ’s terms of use (in
particular, ’s “Community Guidelines” →“What is not allowed”).
• informed the complainant as follows: We have reviewed your information and
found that your review has been removed in accordance with our policies. Our data
shows that some elements of your account match Elements other
accounts that rated the same product.
• did not provide the complainant with the information it requested (i.e. the
algorithm and the specific data on which based its decision) such information
would mean that would have to provide the custodian with information about
fraud prevention procedures that are confidential and protected. A more precise
indication of individual cases would entail risks affecting the integrity of these processes
(e.g. allowing bad actors to reverse develop protection measures and
circumvent them in a way that could harm the responsible).
• In addition, was unable to provide the complainant with the information it
requested because they contain information about the account of other users.
• Therefore, Article 15 (4) GDPR is applicable and did not have to provide the
requested information to the complainant in this case, as this would have affected the
rights and freedoms of others.
3. Outcome of the case
16. At the plenary session on the basis of the information provided, the CNPD did not
identify any breach by the controller of the obligation under Regulation (EU) 2016/679
(GDPR).
17. Therefore, after the completion of the processing of the present case and in the light of
the foregoing considerations, the CNPD considered it appropriate to reject the serious
under Article 60(8) GDPR.
18. The CNPD then consulted the Bavarian State Office for Data Protection Supervision
(Germany) in accordance with Article 60(1) on whether it agreed to discontinue the
case. The Bavarian State Office for Data Protection Supervision (Germany) has
affirmed and confirmed that there is no breach of Article 15 GDPR.
19. The CNPD therefore concluded that no further action was necessary and that the cross-
border complaint could be closed by rejection. By way of derogation from Art. 60(7)
GDPR, the supervisory authority to which the complaint has been lodged adopts the
decision in the event of rejection or rejection of a complaint, informs the complainant
and fails to comply with the controller thereof.
As the supervisory authorities concerned (including BayLDA) have not objected to this draft decision, the
BayLDA adopts this draft decision as a final decision under Article 60(8) of the GDPR. In accordance with
paragraph 239 of Guidelines 02/2022, we ask the CNPD to inform the controller of the decision on our
behalf.
Ansbach, 24.5.2024