CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 18_RECLEU13_2026 of 10 February 2026 of the National Data Protection Commission, in a plenary session, on complaint file No 9.424 lodged against the company [REDACTED] via IMI Article 61 procedure 457641
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the “GDPR”);
Having regard to the Act of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework;
Having regard to the Rules of Procedure of the National Data Protection Commission adopted by Decision No 07AD/2024 of 23 February 2024;
Having regard to the Procedure for complaints before the National Data Protection Commission adopted on 16 October 2020 (hereinafter referred to as the “Complaint Procedure before the CNPD”);
Having regard to the following:
# I. Facts and procedure
1. In the framework of the European cooperation, as provided for in Chapter VII of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR), the Supervisory Authority of Bavaria for the Private Sector in Germany submitted to the National Data Protection Commission (hereinafter: “the CNPD”) a complaint (national reference of the concerned authority: LDA-1085.3-6302/22-I) via IMI in accordance with Article 61 procedure - 457641.
2. The complaint was lodged against the controller [REDACTED] (hereinafter [REDACTED] or the “controller”), who has its main establishment in Luxembourg. Under Article 56 GDPR, the CNPD is therefore competent to act as the lead supervisory authority.
3. The original IMI claim stated the following:
“The complainant complains that the information provided to him in the context of a request for information under Article 15 of the GDPR does not comply in its form, format and content with the requirements of Article 12 of the GDPR, according to which information must be provided in a precise, transparent, consistent and accurate manner.”
1
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 18_RECLEU13_2026 of 10 February 2026 of the National Data Protection Commission, in a plenary session, on complaint file No 9.424 lodged against the company [REDACTED] via IMI Article 61 procedure 457641
4. In essence, the complainant asks the CNPD to order the controller to fully comply with the complainant's access request.
5. The complaint is therefore based on Article 15 GDPR.
6. On the basis of this complaint and in accordance with Article 57(1)(f) GDPR, the CNPD requested [REDACTED] to take a position on the facts reported by the complainant and to provide a detailed description of the issue relating to the processing of the complainant's personal data, in particular with regard to his right of access.
7. The CNPD received the requested information within the deadlines set.
## II. In law
### 1. Applicable legal provisions
8. Article 77 GDPR provides that "without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, (...) if the data subject considers that the processing of personal data relating to him or her infringes this Regulation."
9. In accordance with Article 15 GDPR "The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information (...)";
10. Furthermore, in application of Article 12(2) GDPR "the controller shall facilitate the exercise of data subject rights under Articles 15 to 22". Recital 59 GDPR emphasises that "Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means."
11. Article 56(1) GDPR provides that "(...) the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60";
2
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 18_RECLEU13_2026 of 10 February 2026 of the National Data Protection Commission, in a plenary session, on complaint file No 9.424 lodged against the company [REDACTED] via IMI Article 61 procedure 457641
12. According to Article 60(1) GDPR, "The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other";
13. According to Article 60(3) GDPR, "The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views";
## 2. In the present case
14. Following the intervention of the Luxembourg supervisory authority, the controller confirmed that the complainant requested his personal information using the self-service tool on 5 July 2022 and received a copy of his personal information on 9 July 2022. Two days later, on 11 July 2022, he requested the information pursuant to Article 15(1) GDPR by e-mail, which was addressed on 9 August 2022 within the deadline prescribed by Article 12(3) GDPR. According to the document provided as annexes, his complaint was filed to the data protection authority of the state of Baden Wuerttemberg on 11 July 2022 and forwarded to the Bavarian authority on 11 August 2022. The Bavarian authority first contacted [REDACTED] in this regard on 20 September 2022 – after they responded to the complainant's right of access.
The information provided to the complainant in [REDACTED] letter dated 9 August 2022 mirrored the structure of Article 15(1) GDPR and comprised all listed subsets one by one, which were precise, complete and up-to-date.
The CNPD recognizes that Microsoft Excel is a structured, commonly used, machine-readable electronic form, which fully meets the requirements of Article 15(3) GDPR. Microsoft Excel is the industry-leading traditional tool of choice for presenting and analyzing data, which is easily downloadable and accessible. The GDPR does not specify what is a commonly used electronic form. Not disputing the common use of .CSV or PDF-A files, [REDACTED] points out that several conceivable electronic formats can be used to address data subjects' requests (EDPB Guidelines 01/2022 on data subject rights - Right of access, par. 146). The
3
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 18_RECLEU13_2026 of 10 February 2026 of the National Data Protection Commission, in a plenary session, on complaint file No 9.424 lodged against the company [REDACTED] via IMI Article 61 procedure 457641
CNPD therefore concludes that the alleged difficulties the complainant experienced accessing his files are unfounded.
Since responding to the complainant's data subject access request in 2022, [REDACTED] continued to improve the quality and presentation of the personal information provided. With the help of data aggregation mechanisms implemented in the fourth quarter of 2022, they were able to minimize risks of their customers receiving empty folders as part of their data subject access request. If a customer receives empty files or files containing the number "0", this means that [REDACTED] does not store any data about the customer in this regard. This is also the case with the complainant's data access request and the empty/"0"-folders he received.
The data aggregation mechanisms implemented in the fourth quarter of 2022 also ensure that customers receive a single ZIP file with all their personal information in response to a data subject access request. They can download this file with one click. [REDACTED] provides multiple ZIP files where files are above 2 GB; in this case the customer can download each of the ZIP files.
15. After a second intervention by the CNPD, [REDACTED] further informed the CNPD that they took all the required actions under the GDPR to comply with the complainant's access request.
They enhanced their data aggregation mechanisms since responding to the complainant's request to minimize the instances of empty folders in responses to data subject access requests. [REDACTED] also informed the complainant on 3 January 2023 that they have enhanced their processes and that it is now possible to download all folders with a single click.
The CNPD therefore concludes that the controller has taken all appropriate measures to resolve the matter.
### 3. Outcome of the case
16. The CNPD, in a plenary session, therefore considers that, at the end of the investigation of the present complaint, the controller has taken appropriate measures to grant the complainant's right of access request, in accordance with Article 15 GDPR.
4
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 18_RECLEU13_2026 of 10 February 2026 of the National Data Protection Commission, in a plenary session, on complaint file No 9.424 lodged against the company [REDACTED] via IMI Article 61 procedure 457641
17. Thus, in the light of the foregoing, and the residual nature of the gravity of the alleged facts and the degree of impact on fundamental rights and freedoms, it does not appear necessary to continue to deal with that complaint. Moreover, the CNPD is of the view that the issue has been resolved in a satisfactory manner.
18. Finally, the controller indicates that they are continuously willing to discuss with the CNPD any further steps to provide the complainant with his personal data.
In light of the above developments, the National Data Protection Commission, in a plenary session, after having deliberated, decides:
- To close the complaint file 9.424 upon completion of its investigation, in accordance with the Complaints Procedure before the CNPD. As per Article 60(7) GDPR, the lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller.
Belvaux, dated 10 February 2026
The National Data Protection Commission
Chair
Commissioner
Commissioner
Commissioner
### Indication of remedies
This Administrative Decision may be the subject of an appeal for amendment within three months of its notification. Such an action must be brought by the interested party before the administrative court and must be brought by a lawyer at the Court of one of the Bar Associations.
5