Tasfiye edilen VPN hizmetinde silme talebinin konusuz kalması

EDPBI:SK:OSS:D:2025:3583 — SK SA final decision (Article 17 (Right to erasure (‘right to be forgotten’)))

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

Kópia

National case no. 00375/2025 (prev., 00249/2024-Os)

In Bratislava, Slovakia
01.09.2025

IMI Art.56: 162670
Case register no. 179947

### Official record

to discontinue the processing regarding the complaint pursuant to Sec. 100 (5) of the Act no. 18/2018 Coll. on Personal Data Protection and amending and supplementing certain Acts (hereinafter referred as „Slovak Data Protection Act“)

On November 11, 2020 the Austrian supervisory authority contacted the Office for Personal Data Protection of the Slovak Republic (hereinafter referred to as the "Slovak SA") through the internal IMI system (Art. 56, no. 162670) with a complaint from a complainant (other contact details not given), who objected to the violation of Art. 17 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter as "GDPR") by Tiger At Work & Co. k.s., Klariská 7, 811 03 Bratislava, ID: 46 467 696 (hereinafter referred to as the "controller"). The complainant contacted the controller several times in order to delete his Tiger VPN account, but without success. The office registered the complaint under the number 00375/2025 (previously 00249/2024-Os).

After the investigation of the case, the Slovak SA as LSA decides to discontinue the processing regarding the complaint [national case no. 00375/2025-Os, IMI no. A56 162670, Case register 179947].

### REASONING

On November 11, 2020, the Austrian SA contacted the Slovak SA with a complaint in which the complainant objected to the violation of Art. 17 GDPR.

It follows from the complaint that the complainant exercises his right to be forgotten and he wanted to delete his account with e-mail address on September 30, 2020 through the "Live Support" chatbox. Furthermore, the complainant asked the controller to inform him about the deletion of his account and all his personal data. The complainant probably received an automatic reply, i.e., that he will receive the answer in the chatbox and on his e-mail. On 15.10.2020 and 20.10.2020, the complainant again requested the deletion of his account and related information. According to the complainant, the controller did not respond.

The Slovak SA requested the controller for the cooperation in the matter in question, to state whether it processes the personal data of the complainant, and if so, to what extent, for what purpose and on which legal basis, to state whether and how it handled the request for deletion of his personal data (including VPN account). In case that he did not process

Číslo spisu
00375/2025

Por.č. záznamu
3

Číslo záznamu
012741/2025

Typ záznamu
Záznam pre spis

Forma originálu
Hodnoverne elektronický

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

Kópia

complainant's request, to state to the Slovak SA the reasons why he did not do so and to provide the Slovak SA with additional information related to the matter in question, which he considers relevant.

The controller did not respond to Slovak SA's request for cooperation. The Slovak SA therefore contacted the controller again, but the controller did not respond again. Based on the above-mentioned facts, the Slovak issued to the controller by decision no. 00372/2022-Os-3 dated March 29, 2022 fine according to Sec. 105 (1) of Slovak Data Protection Act, because he did not fulfill the obligation to cooperate with the supervisory authority arising from Sec. 109 of Slovak Data Protection Act. The said decision is not a decision in the matter, but a decision due to non-fulfilment of the obligation under Slovak Data Protection Act.

On June 23, 2022, the company ArTax Consult s.r.o., Klariská 7, 811 03 Bratislava, IČO: 47 030 101 (hereinafter referred to as "ArTax Consult, s.r.o.") contacted the Office and stated, quoting: "The company Tiger at Work has been defuncted for several years and is now going into liquidation - that's why I also checked mailbox and already found the attached decision. The company's servers are being turned off gradually. This will fulfill your request. However, I can confirm that the name or address of the company does not appear in the database."

Pursuant to Art 4 (1) GDPR, for the purposes of this Regulation: 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Pursuant to Art. 4 (7) GDPR, for the purposes of this Regulation: 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Pursuant to Art. 4 (23) GDPR, for the purposes of this Regulation: 'cross-border processing' means either:

(a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

Pursuant to Art. 6 (1) of the GDPR, processing shall be lawful only if and to the extent that at least one of the following applies:

a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

Číslo spisu

00375/2025

Por.č. záznamu

Číslo záznamu

012741/2025

Typ záznamu

Záznam pre spis

Forma originálu

Hodnoverne elektronický

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

Kópia

Pursuant to Sec. 100 (1) of the Slovak Data Protection Act, the proceeding is initiated based on the complaint of a data subject that claims that his or her rights lay down by this Act are directly influenced (hereafter as “the complainant”), or without a complaint.

Pursuant to Sec. 100 (5) (a) of the Slovak Data Protection Act, (5) The Office shall discontinue the complaint if the complaint is manifestly unfounded.

During the investigation of the case Slovak SA find out that the controller is in liquidation, the controller's servers are gradually turned off, and all data on the servers will be deleted, while the company ArTax Consult s.r.o. confirmed to the Slovak SA that the name of the complainant or the address no longer appears in the controller's database. On the basis of abovementioned findings, the Slovak SA decided to discontinue the proceeding regarding the complaint pursuant to Sec. 100 (5) (a) of the Slovak Data Protection Act.

Should the new relevant facts be identified, the case could be reviewed in the personal data protection proceedings.

A complaint may be filed against this official record with the Office pursuant to Act No. 9/2010 Coll. on Complaints, or a motion pursuant to Section 31 (1) of Act No. 153/2001 Coll. on the Public Prosecutor's Office as amended. This does not affect the right to an effective judicial remedy against a legally binding decision of the supervisory authority pursuant to Art. 78 (1) GDPR. Pursuant to Art. 78 (1) GDPR, the complainant can also lodge a lawsuit against a legally binding decision of a Slovak SA to Administrative Court in Bratislava, Račianska 153/A831 53 Bratislava, Slovakia. This lawsuit shall meet the requirements of Sec. 57 and Sec. 182 of the Act no. 162/2015 Coll. the Code of Administrative Procedure.

- The complaint pursuant to Act no. 9/2010 Coll. shall be in writing and can be submitted in paper or electronic form.
- The complaint pursuant to Act no. 9/2010 Coll. shall contain the name, surname and address of the complainant. If the complaint is submitted by a legal entity, it shall contain its name and registered office, name and surname of the person authorized to act on its behalf. The complaint in paper form shall contain the complainant's handwritten signature. If it is possible to deliver documents to the complainant in accordance with this Act in electronic form, the complaint may also contain the complainant's address for such service.
- The complaint pursuant to Act no. 9/2010 Coll. Shall be legible and comprehensible. It shall be clear from whom it is directed, what shortcomings it points out and what the complainant claims.

Head of the Department
of administrative proceedings
Office for Personal Data
Protection of the Slovak Republic

Číslo spisu

00375/2025

Por.č. záznamu

Číslo záznamu

012741/2025

Typ záznamu

Záznam pre spis

Forma originálu

Hodnoverne elektronický

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

Kópia

b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
c) processing is necessary for compliance with a legal obligation to which the controller is subject;
d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Pursuant to Art. 17 (1) of the GDPR, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Pursuant to Art 56 (1) GDPR, without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.

Pursuant to Art 78 (1) GDPR, without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

The purpose of personal data protection proceeding (hereafter as “proceeding”) is to determine whether there was any infringement of the rights of natural persons when their personal data were processed or if there was any violation to this Act or GDPR in the area of personal data protection; and, if any deficiencies are identified, if it is reasonable and useful, to impose corrective measures or impose a fine for violation of this Act or GDPR.

Číslo spisu

00375/2025

Por.č. záznamu

Číslo záznamu

012741/2025

Typ záznamu

Záznam pre spis

Forma originálu

Hodnoverne elektronický

Tasfiye edilen VPN hizmetinde silme talebinin konusuz kalması

Türkçe özet

Hukuki mesele

Sonuç

Karar metni