HBDI (Hesse) - 62334 (IMI Case)

HBDI - 62334 (IMI Case)
Authority:	HBDI (Hesse)
Jurisdiction:	Germany
Relevant Law:	Article 16 GDPR Article 58(2)(b) GDPR Article 60 GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	19.11.2021
Published:
Fine:	n/a
Parties:	A B
National Case Number/Name:	62334 (IMI Case)
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	English
Original Source:	EDPB (in EN)
Initial Contributor:	n/a

The Hessian DPA (HBDI) held that a data subject can exercise their right to rectification under Article 16 GDPR concerning the date of birth, even if it has been indicated incorrectly to make use of different functions or services.

English Summary

Facts

The data subject A created an account with the data controller B. A stated a false name and date of birth, that enabled him to use different functions and services. After A reached the age of majority, they wanted to correct the account name as well as the date of birth. As the customer support of B rejected this request, A filed a complaint with the French DPA (CNIL) suggesting their right to rectification under Article 16 GDPR had been violated.

Holding

The HBDI partly upheld the complaint by stating that the refusal of B to change the date of birth constituted a violation of A's right to rectification. The change of the account name, however, cannot be incorrect and therefore no entitlement to rectification exists. The HBDI issued a warning against B pursuant to Article 58(2)(b) GDPR and urged B to adapt their customer support that these kind of claims are not rejected in the future.

Comment

The decision concerns a cross-border case, with the HBDI acting as the lead supervisory authority under the cooperation procedure of Article 60 GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

                                                           THE HESSIAN COMMISSIONER
                              FOR DATA PROTECTION AND FREEDOM OF INFORMATION


                                                                   19 November 2021

                                  Final Decision


                  Complaint against                                –

                      Right to rectification (Article 16 GDPR)


IMI Case:           62334
IMI A61VMN:         312886

IMI A60DD:          330086


The Hessian Commissioner for Data Protection and Freedom of Information (hereinaf-
ter “HBDI”) refers to the complaint lodged by Mr. L. G. (hereinafter “Complainant”)
against                             (hereinafter “        ”) with the French Data Pro-

tection Authority concerning the right to rectification.



1.     Case Description
The Complainant, who was born on                   2001, created an account with

      in 2014. In order to circumvent restrictions that would have been associated with
a minor's account, he untruthfully stated              1996 as his date of birth. As an
account name, which he was free to choose, the Complainant chose the pseudonym

"              ", the name           being his mother's first name.

After the Complainant had reached the age of majority, he requested the correction of
the account name and the date of birth stored by             .          refused both,
which is why the Complainant lodged a complaint with the French DPA.



2.     Investigation outcome

With regard to the account name, there is no entitlement to rectification. A pseudonym
freely chosen by the data subject cannot be incorrect within the meaning of Article
16(1) GDPR, even if it may contain names or other data of third parties.

Regarding the rejected correction of the date of birth,        was asked by the HBDI

to comment.            replied that the correction had been rejected by the customer
support because the provision of a false date of birth when creating an account violates
the user contract. Depending on the age of the account holder,          would provide

different functions and services. In addition, the request and storage of the date of birth
serves the fulfilment of legal obligations. Since a subsequent change of the date of
birth can have far-reaching consequences, users cannot change it themselves. This is

                                       Page 1 of 2
            ____________________________________________________________________________________________________
   Gustav-Stresemann-Ring 1  65189 Wiesbaden  Telephone +49 6 11 14 08 – 0  Fax +49 06 11 14 08 – 9 00 (or – 9 01)
                 Email poststelle@datenschutz.hessen.de  Web www.datenschutz.hessen.de,                                 Draft Decision – IMI Case 62334
            ____________________________________________________________________________________________________


also pointed out to users when they create an account. Requests to change the date
of birth would be examined more closely by               with regard to possible conse-
quences. After reviewing the facts, the Complainant's date of birth would now be

changed and he would be informed accordingly. This case was also taken as an op-
portunity to review the processes in the customer support and to adjust the underlying

work instructions.



3.     Decision
In its Draft Decision of 07 October 2021, the HBDI has informed the supervisory au-

thorities concerned that it intends to issue a warning to               pursuant to Arti-
cle 58(2)(b) GDPR, as the correction of the Complainant’s date of birth was initially

improperly refused by            ’s customer support. The right to rectification exists re-
gardless of possible consequences under civil law in the contractual relationship be-

tween            and the Complainant. Accordingly, the processes in customer support
must be adapted so that a correction is not generalized rejected in future, comparable
cases. The HBDI found that further measures or sanctions are not necessary, as

       has already initiated the rectification of the Complainant's date of birth as well
as the adjustment of the work instructions on its own initiative. Moreover, the Com-

plainant himself was responsible for the reason for the necessary correction by delib-
erately providing false information. No objections to the Draft Decision were raised by
the supervisory authorities concerned.

The HBDI therefore issued a warning to              and concludes the proceedings with

this Final Decision.



The Hessian DPA






















            ____________________________________________________________________________________________________

   Gustav-Stresemann-Ring 1  65189 Wiesbaden  Telephone +49 6 11 14 08 – 0  Fax +49 06 11 14 08 – 9 00 (or – 9 01)
                  Email poststelle@datenschutz.hessen.de  Web www.datenschutz.hessen.de