AKI (Estonia) - EDPBI:EE:OSS:D:2022:362
| AKI - EDPBI:EE:OSS:D:2022:362 | |
|---|---|
 | |
| Authority: | AKI (Estonia) |
| Jurisdiction: | Estonia |
| Relevant Law: | Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 02.05.2022 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | EDPBI:EE:OSS:D:2022:362 |
| European Case Law Identifier: | EDPBI:EE:OSS:D:2022:362 |
| Appeal: | n/a |
| Original Language(s): | English |
| Original Source: | EDPB (in EN) |
| Initial Contributor: | n/a |
In an Article 60 GDPR decision, the Estonian DPA reprimanded a controller for a violation of Article 17 GDPR. The controller did not erase all personal data after an erasure request. The controller had designed its erasure procedure in such a way that when a data subject did not log out manually from the controller's service after the erasure request, the login details of the data subject would be kept in the controller's database.
English Summary
Facts
The data subject was unable to exercise his right to have his data deleted by the controller. The nature of the controller was not specified. According to the data subject, the data was not deleted despite several appeals and despite multiple confirmations from the controller that his personal data was deleted. The data subject filed a complaint at the Berlin DPA, which transferred the complaint to the Estonian DPA under Article 56 GDPR. The latter started an investigation into the controller and sent it several questions regarding its processing.
The controller stated that the data subject had requested deletion on 19 November 2020 and that the controller deleted the data on the same day. It also explained its standard account deletion procedure, which required the user to manually log out or to delete the controller’s application in order to complete the deletion process. If the user did not do this, his login details (e-mail address and account passcode) would be kept in a database. Where applicable, the controller would not delete, but encrypt and archive personal data in order to comply with the Estonian Money Laundering and Terrorist Financing Prevention Act (the “AML Act”). The controller also confirmed during the proceedings that all personal data of the data subject had now been deleted.
In order to prevent these situations in the future, the controller implemented a forced-logout to its user account deletion procedure. Therefore, data subjects did not have to logout themselves anymore to have all their data erased.
Holding
The Estonian DPA determined that the controller violated Article 17 GDPR. It had not deleted the personal data of data subjects because of its own procedural mistakes. The DPA acknowledged that these procedural mistakes had now been solved by the controller, now that all the personal data had been deleted. The DPA closed the proceedings and reprimanded the controller on the basis of Article 58(2)(b) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
FOR DATAPRIVACYAND FREEDOM OF INFORMATION
ASUTUSESISESEKS
KASUTAMISEKS
Märge tehtud: 02.05.2022 Inspektsioon
Juurdepääsupiirang kehtib kuni:
02.05.2097
Alus: AvTS § 35 lg 1 p 2,AvTS § 35 lg 1
p 12
IMI - Berlin DPA Yours: nr
Ours: {regDateTime} nr
{regNumber}
Reprimand for failure to comply with the requirements of the General Data Protection
Regulation & notice of termination of the proceeding in regard to the protection of
personal data
RESOLUTION:
Reprimand in a personal data protection case in which has
violated the following norm arising from the General Data Protection Regulation
(GDPR): article 17
Case
The Estonian Data Protection Inspectorate (Estonian DPA) received a complaint from
via Internal Market Information System.
According to the complaint the complainant was unable to exercise his right to have the data
deleted. The complainant stated that, despite several appeals, the data was not deleted.
The Estonian DPA explained to the controller that processing of personal data is permitted
only with the consent of the person or other legal basis abiding from law. In the absence of a
legal basis, personal data may not be processed. If personal information processing is not
permitted by law, a person has the right to ask for termination of data processing and
additionally for deletion of data.
Based on the information contained in the complaint, the controller have repeatedly confirmed
to the complainant that his personal information was deleted, so logically the controller had
no further legal basis to process the complainant's data. Additionally the controller did not
explain to the complainant the impossibility of deletion.
For above reasons the Estonian DPA started an investigation and asked questions listed with
answers below.
1. On what date was the specific personal data of data deleted?
Tatari tn 39 / 10134 Tallinn / 627 4135 / info@aki.ee / www.aki.ee
Registrikood 70004235with the account.”
5) What is the legal basis for not deleting all the data and encrypting some of it? Please
be precise – bring out the legal act, provision, section, reason.
s data retention obligations stem from § 47 of the Estonian Money Laundering
and Terrorist Financing Prevention Act (the “AML Act”). Under this provisions,
is required to retain:
- Documents specified in §21, § 22 and §46 of the AML Act (which includes, but is not
limited to documentation relating to proof of residence, date of birth, personal
identification code), information registered in accordance with § 46 and the
documents serving as the basis for identification and verification of persons, and the
establishment of a business relationship for no less than five years after the
termination of the business relationship;
- during the period specified in subsection 1 of § 47, must also
retain the entire correspondence relating to the performance of its duties and
obligations arising from the and all the data and documents gathered in the
course of monitoring the business relationship or occasional transactions as well as
data on suspicious or unusual transactions or circumstances which were not reported
to the Financial Intelligence Unit.
- must also retain the documents prepared with regard to a
transaction on any data medium and the documents and data serving as the basis for
the notification obligations specified in § 49 of the AML Act for no less than five years
after making the transaction or performing the duty to report.
- must retain the documents and data specified in subsections
1, 2 and 3 of § 47 in a manner that allows for exhaustively and without delay replying
to the enquiries of the Financial Intelligence Unit or, in accordance with legislation,
those of other supervisory authorities, investigative bodies or courts, inter alia,
regarding whether has or has had in the preceding five years a business
relationship with the given person and what is or was the nature of the relationship.
- Lastly, deletes the data retained on the basis of § 47 after the
expiry of the time limits specified in subsections 1–6 of § 47, unless the legislation
regulating the relevant field establishes a different procedure. On the basis of a
compliance notice issued by the competent supervisory authority, data of importance
for prevention, detection or investigation of money laundering or terrorist financing
may be retained for a longer period, but not for more than five years after the expiry
of the first time limit.”
6) What exact data are you encrypting and archiving? Is it not possible to anonymize the
data and then archive it?
’s compliance department encrypts and archives the data that is required to be
retained for AML purposes (documentation relating to proof of residence, date of birth,
personal identification code, transaction data), as per the requirements listed in § 47 of the
AML Act.
3 (4)The reason why this data is not anonymized is that this data (documentation relating to proof
of residence, date of birth, personal identification code, transaction data) has a specific
function in relation to our obligations stemming from § 47 of the AML Act - this data is used
to duly verify the identity/residence of our users and screen them against a variety of
sanctions lists and lists pertaining to politically exposed persons. In turn, as per
§ 47, should without delay reply to the enquiries of the Financial Intelligence Unit
or, in accordance with legislation, those of other supervisory authorities, investigative bodies
or courts, inter alia, regarding whether has or has had in the preceding five years
a business relationship with the given person and what is or was the nature of the
relationship.
Anonymizing the above-described data (documentation relating to proof of residence, date of
birth, personal identification code, transaction data) is irreversible and would render it
impractical or even impossible for to comply with its AML reporting obligations.”
Taking into account the fact that the controller did not delete the data subjects data due
to their own procedural mistakes the controller breached article 17 stipulated in the
General Data Protection Regulation (GDPR).
Although the controller has now confirmed that the complainant’s personal data is
deleted (besides the data that they are obligated to retain by law), procedural mistakes
are solved and the controller has improved its data processes (including deletion), we are
closing the proceedings and reprimand on the basis of Article
58 (2) (b) of the GDPR.
Best regards
lawyer
authorised by Director General
4 (4)
