IMI Case Register entry: 492052 (in connection with A56 454116)
Ref. Nos. in National Systems: NAIH-7117/2022, 07141-6/2023/14
Date: 5 December, 2024
The Information Commissioner (hereinafter: the IP) issues, under the Personal Data Protection
Supervisor, on the basis of Article 77 of Regulation (EU) 2016/679 of the European Parliament and of
the Council of 27 April 2016 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General
Data Protection Regulation; hereinafter: the GDPR) and Article 34 in relation to point 2 of paragraph 1
of Article 55 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No.
163/22; hereinafter: ZVOP-2) and conjunction with the General Administrative Procedure Act (Official
Gazette of the Republic of Slovenia, No. 24/06 – official consolidated text, as amended; hereinafter:
ZUP) in the complaint procedure of the complainant:
Hungary, dated 26 August 2022, against the controller:
, in the matter of the right to erasure of
personal data
1
FINAL DECISION
1. It is established that the controller , d.o.o. infringed Article 17 in conjunction
with Article 12 of the GDPR at the time of filing of the complaint by the complainant
on 26 August 2022, by failing to take a timely and appropriate decision on the request for
erasure of personal data.
2. No measures are ordered against the controller regarding the
processing of personal data of the complainant .
3. The complainant is granted full access to the case file No. 07141-6/2023.
4. In this procedure, the authority did not incur any special costs, and each party covers its own costs
of the procedure.
St ate me nt o f g ro und s :
The proceedings to date and relevant submissions made by the parties
The IP received a request from the Hungarian supervisory authority Nemzeti Adatvédelmi és
Információszabadság Hatóság (hereinafter: the Hungarian supervisory authority) in the context of the
procedure for determining the lead supervisory authority under Article 56 of the GDPR to supervise
the legality of the processing of personal data i.e. the complaint, filed by complainant
The complaint states that the complainant registered an account in her own name on the web
portal providing in addition her email address and phone number at the time of
registration. On the same day, she wanted to terminate or delete her account, which the website itself
1
Unofficial translation for the purpose of issuing Final Decision in A6O procedure.
1
did not enable. She therefore sent a request for the deletion of her personal data to the controller
indicated in the privacy policy of the website in question, to at the e-mail
address on 31. 5. 2022. In the complaint filed with the Hungarian supervisory
authority on 26 August 2022, the complainant further states that she has not received any response
from the controller.
After reviewing the complaint, the IP has, in accordance with Articles 9 and 141 of General
Administrative Procedure Act (Official Gazette of the Republic of Slovenia, No. 24/06 – official
consolidated text, as amended; hereinafter: ZUP) in relation to Article 25 of Personal Data Protection
Act (Official Gazette of the Republic of Slovenia, No. 163/22; hereinafter: ZVOP-2) and in accordance
with the powers from Article 28 of ZVOP-2 and Article 58 of the GDPR, asked the controller on 20
March 2023 to either provide a response on the statements of the complainant or to issue a written
decision on the complainant's request in accordance with Articles 12 and 17 of the GDPR in relation to
Article 14 of ZVOP-2.
The controller replied within the set deadline on 5 April 2023 stating that on 31 March 2023 it deleted
the complainant's account and all personal data relating to it and informed the complainant thereof.
The letter to the complainant has been attached to the reply. In the reply, the controller further
explained that the irregularity occurred due to an unintentional human error, as the employee, to
whom the email with the deletion request was addressed, had just left her job during the period in
question.
On 13 April 2023, the IP sent a notification to the Hungarian supervisory authority informing the
complainant of the response of the controller and inviting her to clarify whether she had received the
deletion notice and whether she maintains the complaint.
On 12 May 2023, the complainant replied that she maintains the complaint and wanted an official
decision from the supervisory authority on the controller's violation of the GDPR.
On this basis, the IP issued a record of findings essential for the decision in this procedure together
with a call for a statement before the decision, which it forwarded to the controller on 6 February 2024,
and was forwarded to the complainant by the Hungarian supervisory authority on 21 February 2024. In
the record, the IP found that the controller had violated Article 17 in conjunction with Article 12 of the
GDPR at the time of filing the complaint. However, since the controller had remedied the infringement
after the request by performing the erasure and notifying the complainant, the IP shall not impose any
special measures related to the processing of personal data of the complainant. No party responded
to the call within the set 10-day period from the date of service.
Since the IP considered that the facts of the case had been fully established, it did not carry out any
other procedural steps.
Supervisory procedure
Paragraph 1 of Article 30 of the ZVOP-2 provides that an individual who believes that the processing
of his/her personal data by a controller or a processor infringes the provisions of the GDPR, this Act or
other laws governing the processing or protection of personal data, or infringes the provisions of
related implementing regulations or general acts, may submit a request to the supervisory authority in
accordance with the law governing the general administrative procedure, requesting supervision of the
lawfulness of the processing of his/her personal data, and may also propose the necessary action to
2
be taken in accordance with the previous Article in case of established violations, so as to achieve the
restoration of the lawful situation. The second paragraph of the same Article of ZVOP-2 stipulates that
each party bears its own costs of the proceedings.
Therefore, the IP dealt with the application in a procedure conducted at the request of the complainant
with a special status, which guarantees the right to appeal under Article 77 of GDPR. In this
supervisory procedure, it acted according to the provisions of Articles 30 to 35 of ZVOP-2 (procedure
based on the application of a complainant with a special status). Among other things, this procedure is
characterized by the fact that the IP acts in accordance with the investigative and regulatory powers
established in Article 58 of the GDPR and Articles 28 and 29 of ZVOP-2 and in accordance with the
general rules of administrative procedure act.
After the supervision procedure, the IP, as a supervisory authority, issues a decision in accordance
with paragraph 1 of Article 34 of the ZVOP-2. Such a decision, in addition to the elements specified by
the law governing the general administrative procedure, contains:
1) determination of the existence or non-existence of the alleged infringement of the processing of
personal data of the complainant with a special status at the time of filing the complaint;
2) measures ordered against the controller or processor regarding the processing of personal data
relating to the complainant with a special status, and the deadline for their implementation;
3) permitted scope of review of the case file for a complainant with a special status.
On the right to erasure of personal data
Pursuant to Article 17(1) of the GDPR, the data subject shall have the right, in the exhaustively listed
cases, to obtain from the controller the erasure of personal data relating to her/him without undue delay,
and the controller shall have the obligation to erase the personal data without undue delay.
The controller shall provide the data subject the information on action taken on a request under Articles 15
to 22 of the GDPR without undue delay and in any event within one month of receipt of the request. This
period may be extended by two further months where necessary, taking into account the complexity and
number of requests. The controller shall inform the data subject of any such extension within one month of
receipt of the request, together with the reasons for the delay (Article 12(3) of the GDPR). If the controller
does not take action on the data subject's request, it shall inform the data subject without delay and at the
latest within one month of receipt of the request of the reasons for not taking action and on the possibility
of lodging a complaint with a supervisory authority and seeking a judicial remedy (Article 12(4) of the
GDPR).
Assessment of statements made by the complainant
The IP finds that at the time of filing of the complaint with the Hungarian supervisory authority, i.e. on
26 August 2022, the controller has not yet decided on the complainant's request of 31 May 2022 to
delete her personal data. This is confirmed also by the statement of the controller. As the one-month
deadline for a decision on the erasure request expired, the IP considers that the controller infringed
Article 17 in conjunction with Article 12 of the GDPR at the time of filing of the complaint and decides
as set out in point 1 of the operative part of this decision. However, this infringement was immediately
remedied by the controller after the filling of the complaint and the request by the IP, by deciding on
the complainant's request, granting it and deleting her data, as evidenced by the controller's notice of
deletion sent to the complainant and its response sent to the IP on 5 April 2023.
3
The IP set out these findings, which are essential for the decision in the present proceedings, in the
record and asked the parties to comment on the findings, in accordance with Article 32(2) and Article
33(2) of ZVOP-2. No party responded to the call. The IP considered that the controller completely
remedied the identified infringement of the right to erasure of personal data by granting the
complainant's request, deleting the requested personal data and informing the complainant thereof in
writing. Therefore, the IP did not order the controller to take particular measures in relation to the
processing of the complainant's personal data (point 2 of the operative part of the decision), since the
irregularities found in the processing of the complainant's personal data no longer exist at the time of
the adoption of this decision.
Permissible scope of revision of the case file
Point 3 of paragraph 1 of Article 34 of ZVOP-2 stipulates that the decision in the procedure according
to the provisions of this section, in addition to the elements specified by the law governing the general
administrative procedure, also contains the permissible scope of revision of the case file for the
complainant with special status.
The IP did not restrict the complainant's right to review the file of the case, which is kept under no.
07141-6/2023, as there are no reasons justifying such a restriction (point 3 of the operative part of the
decision).
Costs
Pursuant to the paragraph 1 of Article 118 of ZUP, the authority shall decide on the costs of
procedure, on who is to bear the costs of procedure, on the amount thereof and on whom and in what
time limit they are to be paid by a decision.. No special costs were incurred in this procedure. Pursuant
to the paragraph 2 of Article 30 of ZVOP-2, the complainant and the controller shall each bear their
own costs that they may incur as a result of the procedure, which led the IP to take the decision as set
out in point 4 of the operative part of this decision.
In accordance with the provisions of the Administrative Fees Act (Official Gazette of the Republic of
Slovenia, No. 106/10 - official consolidated text, as amended), this decision is exempt from the
payment of administrative fees.
Instruction on legal remedies:
An appeal against this decision is not permissible, but an administrative dispute may be initiated
against the decision. An administrative dispute may be brought by filing an action with the
Administrative Court of the Republic of Slovenia, Fajfarjeva 33, 1000 Ljubljana. The action must be
filed within thirty days from the service of this decision, either in writing directly to the said court or by
registered mail or orally on record. In addition to the original, transcript or copy of this decision, the
action must also be accompanied by one transcript or copy of the action and attachments for the
defendant, if someone is affected by the decision, than one as well for him or her.
State Supervisor for Personal Data Protection
Recipients:
1. Complainant: – served by the Hungarian supervisory authority,
2. Controller:
.
4