HBDI (Hesse) - 62334 (IMI Case)

HBDI - 62334 (IMI Case)
Authority:	HBDI (Hesse)
Jurisdiction:	Germany
Relevant Law:	Article 16 GDPR Article 58(2)(b) GDPR Article 60 GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	19.11.2021
Published:
Fine:	n/a
Parties:	A B
National Case Number/Name:	62334 (IMI Case)
European Case Law Identifier:	EDPBI:DEHE:OSS:D:2021:296
Appeal:	Unknown
Original Language(s):	English
Original Source:	EDPB (in EN)
Initial Contributor:	n/a

The Hessian DPA (HBDI) held that a data subject has a right to rectification under Article 16 GDPR, even if he or she purposefully provided incorrect information during the account creation in order to circumvent age restrictions.

English Summary

Facts

The data subject created an account with the controller. During the account creation, he used the name of his mother as an account name and an incorrect date of birth, which enabled him circumvent him age restriction of the service. Regarding the account name, he was not obliged to use a real name but was free to choose any Pseudonym he wanted use. After the data subject reached the age of majority, he requested the correction of the account name as well as the date of birth from the controller. As the customer support of the controller rejected the request, the data subject filed a complaint with the French DPA (CNIL) claiming that his right to rectification under Article 16 GDPR had been violated.

Holding

The HBDI partly upheld the complaint, stating that the refusal of the controller to change the date of birth constituted a violation of the data subject's right to rectification. The HDBI, however, found no violation of Article 16 GDPR in relation to the account name, because as a pseudonym can never be incorrect. The HBDI issued a warning against the controller pursuant to Article 58(2)(b) GDPR and urged it to improve their customer support so that these kind of claims will not be wrongly rejected again in the future.

Comment

The decision concerns a cross-border case with the HBDI acting as the lead supervisory authority and the CNIL as an authority concerned under the cooperation procedure of Article 60 GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

                                                           THE HESSIAN COMMISSIONER
                              FOR DATA PROTECTION AND FREEDOM OF INFORMATION


                                                                   19 November 2021

                                  Final Decision


                  Complaint against                                –

                      Right to rectification (Article 16 GDPR)


IMI Case:           62334
IMI A61VMN:         312886

IMI A60DD:          330086


The Hessian Commissioner for Data Protection and Freedom of Information (hereinaf-
ter “HBDI”) refers to the complaint lodged by Mr. L. G. (hereinafter “Complainant”)
against                             (hereinafter “        ”) with the French Data Pro-

tection Authority concerning the right to rectification.



1.     Case Description
The Complainant, who was born on                   2001, created an account with

      in 2014. In order to circumvent restrictions that would have been associated with
a minor's account, he untruthfully stated              1996 as his date of birth. As an
account name, which he was free to choose, the Complainant chose the pseudonym

"              ", the name           being his mother's first name.

After the Complainant had reached the age of majority, he requested the correction of
the account name and the date of birth stored by             .          refused both,
which is why the Complainant lodged a complaint with the French DPA.



2.     Investigation outcome

With regard to the account name, there is no entitlement to rectification. A pseudonym
freely chosen by the data subject cannot be incorrect within the meaning of Article
16(1) GDPR, even if it may contain names or other data of third parties.

Regarding the rejected correction of the date of birth,        was asked by the HBDI

to comment.            replied that the correction had been rejected by the customer
support because the provision of a false date of birth when creating an account violates
the user contract. Depending on the age of the account holder,          would provide

different functions and services. In addition, the request and storage of the date of birth
serves the fulfilment of legal obligations. Since a subsequent change of the date of
birth can have far-reaching consequences, users cannot change it themselves. This is

                                       Page 1 of 2
            ____________________________________________________________________________________________________
   Gustav-Stresemann-Ring 1  65189 Wiesbaden  Telephone +49 6 11 14 08 – 0  Fax +49 06 11 14 08 – 9 00 (or – 9 01)
                 Email poststelle@datenschutz.hessen.de  Web www.datenschutz.hessen.de,                                 Draft Decision – IMI Case 62334
            ____________________________________________________________________________________________________


also pointed out to users when they create an account. Requests to change the date
of birth would be examined more closely by               with regard to possible conse-
quences. After reviewing the facts, the Complainant's date of birth would now be

changed and he would be informed accordingly. This case was also taken as an op-
portunity to review the processes in the customer support and to adjust the underlying

work instructions.



3.     Decision
In its Draft Decision of 07 October 2021, the HBDI has informed the supervisory au-

thorities concerned that it intends to issue a warning to               pursuant to Arti-
cle 58(2)(b) GDPR, as the correction of the Complainant’s date of birth was initially

improperly refused by            ’s customer support. The right to rectification exists re-
gardless of possible consequences under civil law in the contractual relationship be-

tween            and the Complainant. Accordingly, the processes in customer support
must be adapted so that a correction is not generalized rejected in future, comparable
cases. The HBDI found that further measures or sanctions are not necessary, as

       has already initiated the rectification of the Complainant's date of birth as well
as the adjustment of the work instructions on its own initiative. Moreover, the Com-

plainant himself was responsible for the reason for the necessary correction by delib-
erately providing false information. No objections to the Draft Decision were raised by
the supervisory authorities concerned.

The HBDI therefore issued a warning to              and concludes the proceedings with

this Final Decision.



The Hessian DPA






















            ____________________________________________________________________________________________________

   Gustav-Stresemann-Ring 1  65189 Wiesbaden  Telephone +49 6 11 14 08 – 0  Fax +49 06 11 14 08 – 9 00 (or – 9 01)
                  Email poststelle@datenschutz.hessen.de  Web www.datenschutz.hessen.de