CPDP (Bulgaria) - PPN-01-88/2022: Difference between revisions

Latest revision as of 12:34, 10 November 2022

CPDP - PPN-01-88/2022

Authority:	CPDP (Bulgaria)
Jurisdiction:	Bulgaria
Relevant Law:	Article 12(4) GDPR Article 17 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	PPN-01-88/2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Bulgarian
Original Source:	PDPC (in BG)
Initial Contributor:	Nikolija

The Bulgarian DPA upheld that controllers must respond to a data subject's request for erasure, even if the request is not granted. The controller must state the grounds for refusal and available remedies.

English Summary

Facts

The data subject appeared in one video which can be found on the Youtube page of a media service provider (the controller). Subsequently, the data subject filed a complaint with the Bulgarian DPA claiming that the controller had failed to respond to the data subject’s request in relation to the right to erasure under Article 17 GDPR.

According to Article 12(4) GDPR, the data subject should give the data controller a response period of one month before lodging a complaint with the DPA. In this case, the data subject asked for their data to be erased from the Youtube page on 25 January 2022 and lodged a complaint with the DPA on 31 January 2022. However, even after the one month deadline had ended, the controller still had not responded to the data subject. Therefore, the complaints by the data subject were deemed admissible by the DPA.

According to the controller, the data subject gave their consent for participating in the filming and distribution of the audiovisual work project. Further, the data controller allegedly relied on journalistic purposes as a legal basis for processing the personal data of the data subject in this case.

Holding

In relation to consent as a legal basis for processing, the DPA held that the submitted declaration, without any date and addressee, did not constitute valid consent within the meaning of the GDPR. If signed bilaterally, the declaration can be characterised as a written agreement for participation in a TV programme. Therefore, in the absence of consent within the meaning of the GDPR, the data subject cannot rely on the right to be forgotten under Article 17 GDPR.

In relation to journalistic purposes used as a legal basis, the DPA concluded that despite processing information for journalistic purposes, the data processor should comply with the rules stemming from Articles 12-21 GDPR. Therefore, if the controller did not comply with the data subject’s request for erasure of personal data, the controller should have informed the data subject of that fact. The controller should state the reasons why and inform the data subject of the possibility of lodging a complaint with a supervisory authority or court. This should be done without undue delay, but no later than a month after the request was filed.

In this case, the data controller did not respond to the data subject’s request at all, violating Article 12(4) GDPR.

The DPA issued a formal warning to the controller for non-compliance with Article 12(4) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.

@@ Line 61: / Line 61: @@
 }}
-The Bulgarian Personal Data Protection Commission has upheld that data controllers must respond to a data subject's request for erasure, even if the request may not be granted. The controller must state the grounds for refusal and available remedies.
+The Bulgarian DPA upheld that controllers must respond to a data subject's request for erasure, even if the request is not granted. The controller must state the grounds for refusal and available remedies.
 == English Summary ==
 === Facts ===
-The  complainant has complained to the Personal Data Protection Commission (PDPC) that the data controller has failed to respond to the data subject’s request in relation to the right to erasure under article 17 GDPR.
+The data subject appeared in one video which can be found on the Youtube page of a media service provider (the controller). Subsequently, the data subject filed a complaint with the Bulgarian DPA claiming that the controller had failed to respond to the data subject’s request in relation to the right to erasure under [[Article 17 GDPR]].
-The data subject in question has appeared in one video which can be found on the YOUTUBE page of TV X.
+According to [[Article 12 GDPR|Article 12(4) GDPR]], the data subject should give the data controller a response period of one month before lodging a complaint with the DPA. In this case, the data subject asked for their data to be erased from the Youtube page on 25 January 2022 and lodged a complaint with the DPA on 31 January 2022. However, even after the one month deadline had ended, the controller still had not responded to the data subject. Therefore, the complaints by the data subject were deemed admissible by the DPA.
-The data controller in question is Foundation X, which is the registered provider of a linear  media service of TV X.
+According to the controller, the data subject gave their consent for participating in the filming and distribution of the audiovisual work project. Further, the data controller allegedly relied on journalistic purposes as a legal basis for processing the personal data of the data subject in this case.
-According to article 12(4) GDPR, the data subject should give the data controller a response period of one month before lodging a complaint with the PDPC. In this case, the data subject asked for their data to be erased from the youtube page on 25.01.2022 and lodged a complaint with the PDPC on 31.01.2022. However, even after the one month deadline had ended, the controller still had not responded to the data subject. Therefore, the complaints by the data subject were deemed admissible by the PDPC.
-According to the Administrator’s opinion, the complainant has given their consent for participating in the filming and distribution of the audiovisual work for Foundation X’ project. This statement was appealed and was later heard by the PDPC.
-Further, the data controller relied on journalistic purposes as a legal basis for processing the personal data of the data subject in this case. The PDPC analyzed this argument.
 === Holding ===
-In relation to consent, the submitted declaration without any date and addressee does not constitute consent within the meaning of the GDPR. If signed bilaterally, the declaration can be characterized as a written agreement for participation in a TV programme. Therefore, in the absence of consent within the meaning of the GDPR, the data subject cannot rely on the right to be forgotten under article 17 GDPR.
+In relation to consent as a legal basis for processing, the DPA held that the submitted declaration, without any date and addressee, did not constitute valid consent within the meaning of the GDPR. If signed bilaterally, the declaration can be characterised as a written agreement for participation in a TV programme. Therefore, in the absence of consent within the meaning of the GDPR, the data subject cannot rely on the right to be forgotten under Article 17 GDPR.
-In relation to journalistic purposes used as a legal basis, the commission made the following assessment:
-It concludes that despite processing information for journalistic purposes, the data processor should comply with the rules stemming from articles 12-21 GDPR. Therefore, if the controller does not comply with the data subject’s request for erasure of personal data, the controller should inform the data subject that their request will not be complied with.  The controller should state the reasons why and inform the data subject of the possibility of lodging a complaint with a supervisory authority and judicial remedy. This should be done with undue delay, no later than a month.
+In relation to journalistic purposes used as a legal basis, the DPA concluded that despite processing information for journalistic purposes, the data processor should comply with the rules stemming from Articles 12-21 GDPR. Therefore, if the controller did not comply with the data subject’s request for erasure of personal data, the controller should have informed the data subject of that fact. The controller should state the reasons why and inform the data subject of the possibility of lodging a complaint with a supervisory authority or court. This should be done without undue delay, but no later than a month after the request was filed.
-In this case, the data controller did not respond to the data subject’s request at all, not even the one month period has passed, violating article 12(4) GDPR.
+In this case, the data controller did not respond to the data subject’s request at all, violating [[Article 12 GDPR|Article 12(4) GDPR.]]
-The PDPC issued a formal warning to Foundation X for non compliance with article 12(4) GDPR.
+The DPA issued a formal warning to the controller for non-compliance with [[Article 12 GDPR|Article 12(4) GDPR]].
 == Comment ==