CNPD (Luxembourg) - Délibération n° 3018

From GDPRhub
Revision as of 07:47, 3 June 2020 by AD (talk | contribs)
CNPD - 3018
LogoLU.png
Authority: CNPD (Luxembourg)
Jurisdiction: Luxembourg
Relevant Law: Article 27 GDPR
Type: Complaint
Outcome: Other Outcome
Started:
Decided: 04.02.2020
Published: 29.05.2020
Fine: None
Parties: n/a
National Case Number/Name: 3018
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): English
Original Source: Zoller Thierry (in EN)
Initial Contributor: Thierry ZOLLER

Luxembourg DPA argues it cannot proceed against a company established abroad that has not designated an EU Represenative.

English Summary

Facts

Rocketreach sells access to personal data on EU data subjects, allegedly without any legal basis.

Dispute

1. Deleting the data subject's information when all he solely asked for was access.

2. Legal basis of processing.

3. Mass processing.

Holding

Luxembourg DPA argues it cannot proceed against a company established abroad that has not designated an EU Represenative.

Comment

Further Resources

https://blog.zoller.lu/2020/05/how-to-effectively-evade-gdpr-and-reach.html

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.