By e-mail:
Instruction of the case : Paris, September 20th, 2024
Our Ref :
Referral N°
(to be included in all correspondence)
Dear Sir
We come back to you regarding your complaint no. to inform you of the action taken on
your case by the Spanish Data Protection Authority.
You had lodged a complaint with the Commission Nationale de l'Informatique et des Libertés
(CNIL) against regarding the difficulties encountered in exercising your right
to the deletion of your personal data.
As you are aware, in application of the mechanisms for cooperation between authorities provided
for in the General Data Protection Regulation (GDPR), the CNIL has forwarded your complaint to the
Spanish Data Protection Authority, which is competent to deal with requests relating to
insofar as the latter is established on Spanish territory.
Pursuant to Article 77 of the General Data Protection Regulation (GDPR), I hereby inform you of
the decision adopted in this case, following this cooperation procedure.
In this case, you stated in support of your claim that after creating an account on the
website to make an online purchase, you had sent a request to
to delete your online account and all your personal data. In response, the
company asked you to provide proof of your identity. You refused to provide such a document because
it had not been requested when the online account was created, and you insisted that
. delete your personal data, without success.
As part of the investigation into your complaint, the Spanish authorities questionned
The company said that it had asked for proof of identity because the deletion request was made
only seven days after the online purchase. At that time, however, the product had not yet been
delivered and the sales contract was still being fulfilled.
In addition, pointed out that the product purchased was covered by a
2-year warranty and that deleting the online account could have consequences in terms of returning
the product or benefiting from the aforementioned warranty. The company therefore wanted to
ensure that the deletion request actually came from the customer.
On 20 January 2024 you informed the CNIL that you had once again exercised your right to
erasure with the company and had obtained the deletion of your personal
data. The CNIL informed the Spanish authorities of this information and closed your complaint.
It is clear from the above that a response has been given to your request and that
has proceeded to delete your data.
However, for procedural reasons, I would like to inform you that the Spanish Data Protection
Authority has issued a decision to dismiss the complaint. It stated that the breach of Article 12 of
the General Data Protection Regulation (GDPR) 1 , which could possibly have been upheld in this
case, became time-barred on 10 January 2023. Under Spanish law, the limitation period for this
type of breach is one year.
In view of these factors, and the fact that has responded to your
request for deletion in accordance with the provisions of Article 17 of the GDPR, I hereby
inform you that, in agreement with the European data protection authorities, your complaint
has been rejected.
Yours sincerely
1 Article 12 of the GDPR: "[...] 2. The controller shall facilitate the exercise of the rights conferred on the data
subject under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to comply
with the data subject's request to exercise his or her rights under Articles 15 to 22, unless the controller demonstrates
that he or she is unable to identify the data subject.
3. The controller shall provide the data subject with information on the measures taken in response to a request
made pursuant to Articles 15 to 22, as soon as possible and in any event within one month of receipt of the request
[...]."