View source for BlnBDI (Berlin) - 631.457.4 521.14765.10

=== Holding ===
''First'', the DPA determined that there was no legal basis for the processing of the data subject's e-mail address, in violation of [[Article 6 GDPR]].

''Second'', the DPA determined that the controller did not respond to the data subject's requests for erasure within one month, which resulted in violations of [[Article 12 GDPR|Articles 12(3)]] [[Article 17 GDPR|and 17 GDPR.]] The fact that the data subject did not address her request for erasure to the controller's DPO but to its customer service did not justify the controller's failure to reply in time. Nevertheless, there was no obligation in the GDPR for data subjects to submit their requests electronically, nor was there an obligation to send requests only to a specific e-mail address, pursuant to [[Article 15 GDPR|Article 15(3) GDPR.]] 

The DPA reprimanded the controller pursuant to [[Article 58 GDPR|Article 58(2)(b) GDPR]].