AEPD - R/00232/2021
|AEPD - R/00232/2021|
|Relevant Law:||Article 12(6) GDPR|
Article 15 GDPR
Article 17 GDPR
|Parties:||GOKOAN EDUCATION, S. L.|
|National Case Number/Name:||R/00232/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD decision (in ES)|
The Spanish DPA decided that a controller could not require a data subject to identify themselves with their national ID, when this document had not been asked for in the first place. In this instance, the controller had no reason to doubt the identity of the data subject.
English Summary[edit | edit source]
Facts[edit | edit source]
A complainant asked a controller to erase all the personal data related to them. This included study and educational data and the subscription to a newsletter.
The controller accepted to erase the data related to the newsletter, therefore stopping such processing, but refused to delete the study and educational data without proof of the data subject identity, asking for their national ID card in order to verify it, with grounds in Article 12(6) GDPR.
Holding[edit | edit source]
The AEPD held that, given that the controller had not asked for their national ID card when obtaining the complainant's data, it was not necessary to ask for it for the exercise of their rights. The authority argued that there were no doubts regarding the identity of the data subject, as they had signed up for the services of the controller, and therefore provided their data, using the same email account used to lodge the erasure request.
Hence, the AEPD ordered the controller to comply with the erasure request without further requirements to the data subject.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.