Summary Final Decision Art 60
Complaint
EDPBI:LT:OSS:D:2024: 1361
Administrative fine
Background information
Date of final decision: 02 July 2024
LSA: LT
CSAs: FR, DE, PL, NL, ES
Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6
(Lawfulness of processing), Article 12 (Transparent information,
communication and modalities for the exercise of the rights of the data
subject), Article 24 (Responsibility of the controller)
Decision: Administrative fine
Key words: Lawfulness of processing, Exercise of data subject rights, Principles
relating to processing of personal data, Legitimate interest,
Transparency, Accountability
Summary of the Decision
Origin of the case
The LSA carried out an investigation following the complaints against the controller by the controller’s
platform users forwarded by FR and PL SAs in 2021 and 2022, respectively, alleging that the controller
had not properly implemented their requests regarding the right to erasure (‘right to be forgotten’)
and the right of access.
Findings
Firstly, the LSA found that the controller, in its responses to the complainants’ requests for erasure of
personal data, stated that it would not act on a specific request, because the complainant concerned
did not identify a specific reason under Article 17(1) GDPR. The LSA highlighted that the data subject
may request the controller to erase personal data, even without giving specific reasons. Upon receipt
of the data subject’s request for erasure of personal data, the controller must assess whether at least
one of the grounds set out in Article 17(1)(a) to (f) GDPR applies in the specific case (including when it
is necessary to request the data subject to clarify the necessary information) or the absence of the
exceptions referred to in Article 17(3) GDPR. Thus, the controller cannot refuse to act on the data
subject’s request for the erasure of personal data on the sole ground that the data subject has failed
to provide specific grounds in line with Article 17(1) GDPR. Moreover, the LSA underlined that the
controller, after having ascertained that there were no grounds for action at the request of a particular
data subject, was obliged to inform the data subject of the reasons for not taking action in a concise,
transparent, intelligible and easily accessible form, in clear and plain language, i.e. indicate that it had
fulfilled its obligation under Article 17 GDPR. Finally, in this specific case the controller also failed to
indicate all the specific purposes for which the complainants’ specific personal data would continue
to be processed after the request was made in accordance with Article 17 GDPR. Based on these
elements, the LSA found that the controller infringed Article 5(1)(a) GDPR (the principles of fairness
and transparency) and Article 12 (1) and (4) GDPR.
In addition, the LSA noted that the controller was obliged to implement appropriate technical and
organisational measures in order to be able to demonstrate to the supervisory authority that,
following a request under Article 15 GDPR, the data subject was provided with the information
required by Article 12(3) or (4) GDPR. The LSA recalled that the principle of accountability under
Article 5(2) GDPR provides that the controller is responsible for compliance with Article 5(1) GDPR and
must be able to demonstrate this to the supervisory authority. Since the controller failed to
demonstrate that it had taken or refused to act in accordance with the specific complainant’s request
(and to inform the complainant in a transparent and fair manner), the LSA found that the controller
infringed Article 5(2) GDPR.
Furthermore, the LSA found that the controller unlawfully processed personal data of some of the
complainants in the context of ‘shadow blocking’. Within the scope of this decision, 'shadow blocking'
referred to the processing of personal data conducted by the controller to facilitate the leave of a
malicious user (someone violating the operating principles of the controller’s platform) from the
platform without being aware of such processing of their personal data, thereby ensuring the security
of the controller’s platform and its users. The controller stated that the ‘shadow blocking’ was carried
out under the legal basis of legitimate interest in accordance with Article 6(1)(f) GDPR. When
assessing the compliance with the conditions to rely on this legal basis under Article 6(1)(f) GDPR, the
LSA found that, while the interests pursued by the controller were legitimate, the ‘shadow blocking’
was not necessary and proportionate, i.e. the legitimate aims and interests of the controller could be
achieved by other, less intrusive measures. Moreover, the LSA found that such processing failed to
pass the balancing test under Article 6(1)(f) GDPR, in particular as the data subjects could not expect
such processing of their personal data and as it resulted in a disproportionately negative impact on
their interests and fundamental rights. Therefore, the controller could not rely on the legal basis of
legitimate interest in this case. Consequently, the LSA found that the controller infringed Article
5(1)(a) (the principle of lawfulness) and Article 6(1) GDPR.
Decision
In light of the above, the LSA decided to impose a fine of EUR 2.385.276. When deciding on the amount
of the fine in accordance with Article 83 GDPR, the LSA relied on the European Data Protection Board
Guidelines 04/2022 of 24 May 2023 on the calculation of administrative fines under the GDPR and
took into account, for example, the cross-border scope of the processing carried out by the controller,
a large number of data subjects affected infringements and their duration.