Erişim ve Silme Hakkı Süreci

EDPBI:LU:OSS:D:2025:3637 — LU SA final decision (Article 15 (Right of access by the data subject), Article 17 (Right to erasure (‘right to be forgotten’)), Article 6 (Lawfulness of processing))

Deliberation No 78_RECL59_2025 of 26 September 2025 of the
COMMISSION
NATION ALE
National Data Protection Commission, in a plenary session, on
f>OURLA
Pro· cc·10N
complaint file No 2.077 lodged against the company--
OESOONNHS - via IMI Article 56 procedure 51068

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of natural persons with regard to the processing of personal data and
on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the 'GDPR');

Having regard to the Act of 1 August 2018 on the organisation of the National Data Protection
Commission and the general data protection framework (hereinafter: the 'Law of 1 August
2018');

Having regard to the Rules of Procedure of the National Data Protection Commission adopted by
Decision No 07 AD/2024 of 23 February 2024 (hereinafter: the 'ROP');

Having regard to the Procedure for complaints before the National Data Protection Commission
adopted on 16 October 2020 (hereinafter: the 'Complaint Procedure before the CNPD');

Having regard to the following:

I. Facts and procedure

1. In the framework of the European cooperation, as provided for in Chapter VII of
Regulation (EU) 2016/679 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data. and repealing
Directive 95/46/EC (General Data Protection Regulation or GDPR), the
Supervisory Authority of France submitted to the National Data Protection
Commission (hereinafter: "the CNPD") a complaint (national reference of the
concerned authority: 18014765) via IMI in accordance with Article 56 procedure -
51068.

2. The complaint was lodged against the Controller (hereafter "the
Controller"), who has its main establishment in Luxembourg. Under Article 56
GDPR, the CNPD is therefore competent to act as the lead supervisory authority.

3. The original IMI claim stated the following:
" The complainant subscribed to a Premium Access on the online
website (now referring to• • •). Its subscription has been tac;tty renewed and
his bank details have been retained and used as such alledgedly without his
consent. He thus asked for withdrawal from the contract and for obtaining access
to, and erasure of, his personal data. The complainant never received access to
his personal data, nor the confirmation of erasure of his personal data. In addition,

he alleges that has used and retained his banking data without his
consent. "

4. In essence, the complainant asks the CNPD to request the Controller to grant the
complainant's right of access as well as to close the complainant's account and
delete any related personal data.

5. The complaint is therefore based on Article 15 and 17 of the GDPR.

6. On the basis of this complaint and in accordance with Article 57( 1)(f) GDPR, the
CNPD requested the Controller to take a position on the facts reported by the
complainant and to provide a detailed description of the issue relating to the
processing of the complainant's personal data, in particular with regard to the right
of access and the right to erasure.

7. The CNPD received the requested information within the deadlines set.

II. In law

1. Applicable legal provisions

8. Article 77 GDPR provides that "without prejudice to any other administrative or
judicial remedy, eve,y data subject shall have the right to lodge a complaint with
a superviso,y author;ty, (. ..) if the data subject considers that the processing of
personal data relating to him or her infringes this Regulation."

9. In accordance with Article 15 of the GDPR " The data subject shall have the right
to obtain from the controller confirmation as to whether or not personal data
concerning him or her are being processed, and, where that is the case, access
to the personal data and the following information (. ..)";

10. Pursuant to Article 17 GDPR, a data subject may request the erasure of his or her
personal data and the Controller must erase the data subject's personal data
without undue delay if one of the grounds provided for in Article 17( 1) GDPR
applies unless the Controller can demonstrate that the processing falls within the
scope of one of the exceptions set out in Article 17(3) GDPR.

11. Furthermore, in application of Article 12(2) of the GDPR "the controller shall
facilitate the exercise of data subject rights under Articles 15 to 22". Recital 59 of
the GDPR emphasises that "Modalities should be provided for facmtating the

exercise of the data subject's rights under this Regulation, including mechanisms
to request and, if applicable, obtain, free of charge, in particular, access to and
rectification or erasure of personal data and the exercise of the right to object. The
controller should also provide means for requests to be made electronically,
especially where personal data are processed by electronic means."

12. Article 56(1) GDPR provides that "( ... ) the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing
carried out by that controller or processor in accordance w;th the procedure
provided in Article 60";

13. According to Article 60(1) GDPR, "The lead supervisory authority shall cooperate
with the other supervisory authorities concerned in accordance with this Article in
an endeavour to reach consensus. The lead supervisory authority and the
supervisory authorities concerned shall exchange all relevant information w;th
each other';

14. According to Article 60(3) GDPR, "The lead supervisory authority shall, without
delay, communicate the relevant information on the matter to the other
supervisory authorities concerned. It shall without delay submit a draft decision to
the other supervisory authorities concerned for their opinion and take due account
of their views";

2. In the present case

15. Following the first intervention of the CNPD, the Controller confirmed that:

• The complainant's profile was deleted on 01/08/2018 in accordance with
GDPR law. Only the payment information is kept for 10 years.
- has also refunded 119,70 EUR as requested by the complainant,
considering the complainant's request to delete his account in June 2018.
therefore considered this matter as closed .

16. After a second intervention by the CNPD, the Controller further informed the
CNPD that:

• It has sent the complainant an email with the information about his
personal data. It has already deleted all personal data of the complainant
(i.e. his profile data, like search profile, transaction data: chats, etc.) except

the part which has to be mandatory stored for Luxemburg tax law
requirements.

• The only data to be stored for tax reasons is payment data. Payment data
will be automatically deleted after the Luxemburg tax storage period of ten
years has expired.

• Payment data means what is described in Privacy
statement:

"Premium member profile
When you register as a Premium member, we also collect :
Home address, first and last name, telephone number and payment
details. We transmit the credit card data to our contractual payment service
provider via a secure connection and store it in an anonymised form only. "

(Original text in French : "Profil de membre Premium
Dans le cadre d'une inscription en tant que membre Premium, nous
collectons en outre :
Adresse de residence, prenom et nom, numero de telephone et
coordonnees de paiement. Nous transmettons Jes donnees de carte de
credit a notre fournisseur contractuel de services de paiement via une
connexion securisee et nous ne Jes enregistrons que de maniere
anonymisee.")

• The complainant paid via cred it card, i.e. payment was processed via one
of■■■■■■ Payment Service Providers and its acquiring bank. They
have to follow the strict credit card schemes of VISA/Mastercard and are
regulated by state control which goes even beyond the GDPR
requirements - ■•••• does not store any full bank data of
customers.

• Concerning the question about the complainant's contract terms:
In June 2018, the complainant purchased a Premium membership with a
one-month initial period which renews into 3 months periods. The
complainant was provided with all information required by EU consumer
protection laws and GDPR:
- Total price of initial period , payment is a one-time payment for each
period, termination period for initial period, info about automatic

renewal into 3 month periods and price for the renewal periods (also
one-time payment), termination period for renewal periods;
Information about • • • • • General Terms and Conditions and
the Privacy Policy (to both the complainant already agreed when he
registered for his free profile before) and about his right of withdrawal;

• In July 2018, the complainant's Premium membership was renewed once
into a 3 months membership (this info was also given to him before his
purchase of the one month Premium membership).

• The complainant sent a cancellation notice to , therefore his
Premium membership was terminated by the end of this 3 months renewal
period.

17. After a third intervention by the CNPD, the controller further clarified that:

• The retention period for payment data generally begins when the individual
contract on which the underlying transaction is based has ended. In the
current case, this would be an initial order and each renewal. Example: if
a customer has placed an initial order on 1st October, expiring on 31
December and booked three consecutive renewals of three months each,
this would mean that four different triggers for deletion periods would
apply. It should be noted that, according to what • • • • • already
stated in its previous answer, payment data is:
- not full bank data but, depending on the payment made by the
customer, tokenized or cropped data (this has also been pointed
out in ·•-■Ill data privacy policy);
- according to data privacy policy not including home
address, first name, surname and telephone number.

• The legal basis for retaining tax relevant data (which may contain personal
data) in Luxemburg is Article 16 II of the Commercial Code.

• clarified that it generally collects home address, first name
and surname, telephone number and payment data. However, this does
not mean that it retains the telephone number for the tax-related statutory
retention period, since this would not be necessary. • • • • • only
retains payment data for that amount of time since in its view it would be
obliged to share this with tax authorities to demonstrate that the underlying
revenues have been made.

3. Outcome of the case

18. The CNPD, in a plenary session, therefore considers that, at the end of the
investigation of the present complaint, the Controller has taken appropriate
measures to grant the complainant's right of access request, in accordance with
Article 15 of the GDPR.

19. The CNPD also considers that the Controller has demonstrated that the
complainant's data has been erased, except from the transaction data, which must
be kept ten years according to Article 16 of the Luxembourg commercial code.

20. Thus, in the light of the foregoing, and the residual nature of the gravity of the
alleged facts and the degree of impact on fundamental rights and freedoms, it
does not appear necessary to continue to deal with that complaint. Moreover, the
CNPD is of the view that the issue has been resolved in a satisfactory manner.

21. The CNPD then consulted the supervisory authority of France, pursuant to Article
60(1), whether it agreed to close the case. The Supervisory Authority of France
agreed that this case can be closed, given that the remaining concerns raised in
the complaint relate to a commercial dispute. The CN PD has therefore concluded
that no further action was necessary and that the cross-border complaint could be
closed .

In light of the above developments, the National Data Protection Commission, in a
plenary session, after having deliberated, decides:

- To close the complaint file 2.077 upon completion of its investigation , in accordance
with the Complaints Procedure before the CNPD and after obtaining the agreement of
the concerned supervisory authority. As per Article 60(7) GDPR, the lead supervisory
authority shall adopt and notify the decision to the main establishment or single
establishment of the Controller.

Belvaux, dated 26 September 2025

The National Data Protection Commission

Chair Commissioner Commissioner Commissioner

Indication of remedies

This Administrative Decision may be the subject of an appeal for amendment within three months
of its notification . Such an action must be brought by the interested party before the administrative
court and must be brought by a lawyer at the Court of one of the Bar Associations.

Erişim ve Silme Hakkı Süreci

Türkçe özet

Hukuki mesele

Sonuç

Karar metni