1(3)
COMPLAINANT
See appendix
TILLSYNSOBJEKT
CDON AB
Diarienummer:
IMY-2023-16164 Final decision under the General Data
Protection Regulation – CDON AB
Nationell ref:627/154/21¨
IMI case register:
580527
Decision of the Swedish Authority for Privacy Protection
Datum:
2024-11-14
The Swedish Authority for Privacy Protection (IMY) finds that CDON AB 556406-1702
has processed personal data in breach of Article 17 of the General Data Protection
Regulation (GDPR)1 by failing to comply with the complainant’s request for erasure.
Pursuant to Article 58(2)(c) of the GDPR, IMY orders CDON AB to comply with the
complainant’s request to exercise its right to erasure under Article 17 of the GDPR.
This is done by erasing, subject to any applicable exceptions in Article 17(3) of the
GDPR, all personal data that CDON AB processes about the complainant and
informing the complainant of these measures in accordance with Article 12(3). The
measures shall be implemented no later than two weeks after this decision has
become final.
The case is closed.
Presentation of the supervisory case
IMY has initiated supervision regarding CDON AB (CDON AB) due to a complaint.
The complaint has been submitted to IMY as the lead supervisory authority under
Article 56 GDPR. The handover has been made from the supervisory authority of the
country where the complainant lodged his complaint (Finland) in accordance with the
Regulation’s provisions on cooperation in cross-border processing.
Since it is a cross-border complaint, IMY has used the mechanisms for cooperation
and consistency in the GDPR. The concerned supervisory authorities have been the
data protection authorities of Finland, Denmark, Norway and Italy.
The complainant essentially states the following: The complainant requested erasure
according to article 17 GDPR from CDON AB on January 18th 2021. The complainant
received an email from CDON AB on January 20th 2021 asking the complainant for
Postadress:
more information to be able to comply with the request.
Box 8114
104 20 Stockholm
CDON AB essentially states the following. CDON AB is the controller for the
Webbplats:
www.imy.se processing of personal data to which the complaint relates. The complainant submitted
E-post:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telefon: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Page 1 of 3
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16164 2(3)
Datum: 2024-11-14
his request for erasure on January 18th 2021 by email. The request has not been met
because the complainant did not reply to the security questions asked by CDON AB in
order to verify and identify the complainant. The questions are asked in order to
ensure that the person who requested erasure is the correct data subject. Since the
identity of the complainant could not be verified, CDON AB considered themselves to
be prevented from complying with the request of erasure, as it would be in breach of
the requirements of appropriate technical and organisational security (Article 32
GDPR). CDON AB only requested answers to two of the questions asked, in order to
verify the data against the data already processed about the data subject. CDON AB
always strives to minimise the risk of handling data subjects’ personal data due to the
possibility of false requests. Against this background, CDON AB has not been able to
meet the complainant’s request for erasure.
CDON AB further states that CDON AB was unable to assess whether the person who
contacted them was actually the person they claimed to be. In those circumstances,
CDON AB considered that they had reasonable grounds to doubt the complainant’s
identity at that time. CDON AB considered that the gravity of the consequences would
be significant if the wrong individual’s personal data were to be erased, as well as if
the personal data were to be erased at the request of the wrong party. The answers to
the questions asked by CDON AB were about data that was already available to
CDON AB because the data subject provided it when creating a user account and
when they completed payment for their last order.
IMY has sent CDON AB’s statement to the supervisory authority of the country where
the complainant lodged their complaint (Finland) to give the complainant opportunity to
comment on CDON AB’s statement. The complainant has not responded.
Motivation for the decision
Furthermore, it follows from Article 5(2) that the controller must be responsible for and
be able to demonstrate compliance with the principles listed in Article 5(1)
(‘accountability’).
Article 24 of the GDPR regulates the liability of the controller. The article states that,
taking into account the nature, scope, context and purposes of processing and the
risks, of varying likelihood and severity, to the rights and freedoms of natural persons,
the controller shall implement appropriate technical and organisational measures to
ensure and be able to demonstrate that the processing is carried out in accordance
with this Regulation.
According to Article 17(1) GDPR, the data subject shall have the right to obtain from
the controller the erasure of his or her personal data without undue delay and the
controller shall be obliged to erase personal data without undue delay, under certain
conditions set out in the relevant article.
The controller may, where it has reasonable doubts as to the identity of the natural
person making the request pursuant to Article 17, request the provision of additional
information necessary to confirm the identity of the data subject. This follows from
Article 12(6) of the GDPR.
CDON AB has described its procedures for identifying data subjects, but has not
provided any explanation of concrete circumstances as to why CDON AB had reason
to doubt the identity of the complainant. IMY finds that no other evidence has been
Page 2 of 3
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16164 3(3)
Datum: 2024-11-14
found to show that CDON AB had reason to doubt the identity of the complainant.
Against this background, IMY considers that CDON AB had no reason to doubt the
identity of the complainant. CDON AB has thus not shown that they were justified in
refusing to comply with the complainants request. IMY therefore finds that CDON AB
has failed to comply with Article 17 of the GDPR.
Pursuant to Article 58(2)(c) of the GDPR, IMY orders CDON AB to comply with the
complainant’s request to exercise its right to erasure under Article 17 of the GDPR.
This is done by erasing, subject to any applicable exceptions in Article 17(3) of the
GDPR, all personal data that CDON AB processes about the complainant and
informing the complainant of these measures in accordance with Article 12(3). The
measures shall be implemented no later than two weeks after this decision has
become final.
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.
______________________
Appendix
The complainant’s personal data
Page 3 of 3