CPDP (Bulgaria) - PPN-01-88/2022

From GDPRhub
Revision as of 12:34, 10 November 2022 by Kk (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
CPDP - PPN-01-88/2022
LogoBG.jpg
Authority: CPDP (Bulgaria)
Jurisdiction: Bulgaria
Relevant Law: Article 12(4) GDPR
Article 17 GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided:
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: PPN-01-88/2022
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Bulgarian
Original Source: PDPC (in BG)
Initial Contributor: Nikolija

The Bulgarian DPA upheld that controllers must respond to a data subject's request for erasure, even if the request is not granted. The controller must state the grounds for refusal and available remedies.

English Summary

Facts

The data subject appeared in one video which can be found on the Youtube page of a media service provider (the controller). Subsequently, the data subject filed a complaint with the Bulgarian DPA claiming that the controller had failed to respond to the data subject’s request in relation to the right to erasure under Article 17 GDPR.

According to Article 12(4) GDPR, the data subject should give the data controller a response period of one month before lodging a complaint with the DPA. In this case, the data subject asked for their data to be erased from the Youtube page on 25 January 2022 and lodged a complaint with the DPA on 31 January 2022. However, even after the one month deadline had ended, the controller still had not responded to the data subject. Therefore, the complaints by the data subject were deemed admissible by the DPA.

According to the controller, the data subject gave their consent for participating in the filming and distribution of the audiovisual work project. Further, the data controller allegedly relied on journalistic purposes as a legal basis for processing the personal data of the data subject in this case.

Holding

In relation to consent as a legal basis for processing, the DPA held that the submitted declaration, without any date and addressee, did not constitute valid consent within the meaning of the GDPR. If signed bilaterally, the declaration can be characterised as a written agreement for participation in a TV programme. Therefore, in the absence of consent within the meaning of the GDPR, the data subject cannot rely on the right to be forgotten under Article 17 GDPR.

In relation to journalistic purposes used as a legal basis, the DPA concluded that despite processing information for journalistic purposes, the data processor should comply with the rules stemming from Articles 12-21 GDPR. Therefore, if the controller did not comply with the data subject’s request for erasure of personal data, the controller should have informed the data subject of that fact. The controller should state the reasons why and inform the data subject of the possibility of lodging a complaint with a supervisory authority or court. This should be done without undue delay, but no later than a month after the request was filed.

In this case, the data controller did not respond to the data subject’s request at all, violating Article 12(4) GDPR.

The DPA issued a formal warning to the controller for non-compliance with Article 12(4) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.