ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
Ours: 11.11.2024
Final decision
Notice on the termination of proceedings
Estonian Data Protection Inspectorate (hereinafter the Inspectorate) received a complaint from
a Spanish resident via the cross-border procedural system IMI on the 7 June 2023, which was
forwarded by the Spanish SA. According to the complainant, they performed an internet search
and found their name on the website of (hereinafter the Controller) in relation
to being a board member of two companies which they no longer had connections to. The
complainant claims that they wrote to the controller in order to exercise the right to erasure but
received no response. In addition, the complainant´s data was not erased. The complainant
included a letter sent to the Controller on 28 May 2022, in which they asked to erase the data
from the Controller´s website which portrayed their name in connection to two legal entities,
which he no longer had any ties to: and . An outtake from the
website was included in this letter. The complainant alleged there had been a violation of the
GDPR and requested the supervisory authority to take action against the controller.
Article 17(1) of the General Data Protection Regulation (GDPR) gives a person the right to
request the erasure of their data and the controller is obliged to erase personal data without
undue delay if one of the circumstances listed in that provision exists. The data controller need
not erase the data if the processing is necessary for the reasons referred to in Article 17(3).
On the basis of the above, the Inspectorate initiated supervisory proceedings on the basis of
Section 56(3)(8) of the Personal Data Protection Act. As part of the supervisory procedure, an
inquiry was sent to the Controller on 13 July 2023. The Controller was asked whether the
complainant´s personal data was still disclosed on the Controller´s website in relation to the
legal entities the complainant had referred to. The Controller was also asked to clarify the legal
basis for processing this data in case it was in fact still being published. The Inspectorate
received a reply from the Controller on 20 July 2023 in which the controller indicated that no
personal data is being published on their website in connection with the legal entities indicated
by the complainant. In addition, the Inspectorate carried out their own inspection of the
Controller´s website and did not find any personal data published relating to the complainant.
The Inspectorate finds that in the current case there is no infringement of Article 17(1) of the
GDPR since no personal data is being published on the Controller´s website regarding the two
entities that were listed in the complaint.
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
However, an additional analysis of a potential infringement of 12(3) GDPR is required as the
complainant did not receive a reply to his e-mail. Article 12(3) GDPR states: „The controller
shall provide information on action taken on a request under Articles 15 to 22 to the data
subject without undue delay and in any event within one month of receipt of the request. That
period may be extended by two further months where necessary, taking into account the
complexity and number of the requests. The controller shall inform the data subject of any such
extension within one month of receipt of the request, together with the reasons for the delay.
Where the data subject makes the request by electronic form means, the information shall be
provided by electronic means where possible, unless otherwise requested by the data
subject.“ Regarding the controller´s obligation to reply to data subject´s request under article
17(1) GDPR, the Inspectorate issued a follow-up inquiry to the Controller. The Controller
explained in its reply that it was unable to recognize the complainant´s letter as a request made
under article 17(1) GDPR as it was provided fully in Spanish. A copy of the complainant´s
initial letter to the Controller was also included in the response. The Inspectorate takes account
of the fact that this letter was provided only in Spanish. Moreover, the title of the e-mail did not
make reference to GDPR by using the internationally recognized abbreviation which would
have made probable for the controller to identify the e-mail as a request made under the GDPR.
The Inspectorate notes that the Controller has made its website available in English and in
Estonian. Thus, it has not aimed its services directly to Spanish-speaking individuals. There is
no question that a controller has to be able to at least identify and handle requests made in the
languages that it provides its services. This means, that if a request had been submitted in
English, the Controller would have had the obligation to provide a reply within one month
pursuant to article 12(3) GDPR. However, it cannot be required that a controller must have
resources to identify and assess such requests if they are provided in languages other than the
languages that it has decided to offer its services in, especially in cases where there is no
reference to the abbreviation „GDPR“ in the title of such letters. This would result in a need to
translate and assess each e-mail sent to the company mailbox in any of the official languages
of the EU in case it might contain a request related to the GDPR, which would place a
disproportionate burden on the controller and require a considerable amount of additional
resources. For the aforementioned reasons, the Inspectorate concludes that no infringements of
art 12(3) could be deduced in the case at hand.
Based on the above, the Inspectorate did not detect any violation of data subject’s rights
and therefore will terminate the proceedings concerning the protection of personal data
by the Controller.
Best regards
Lawyer
authorized by Director General
2 (2)