Commissioner (Cyprus) - Freedom Finance Europe Ltd
| Commissioner - Freedom Finance Europe Ltd | |
|---|---|
 | |
| Authority: | Commissioner (Cyprus) |
| Jurisdiction: | Cyprus |
| Relevant Law: | Article 12(2) GDPR Article 12(4) GDPR Article 17 GDPR Article 56 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 22.01.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | Freedom Finance Europe Ltd |
| National Case Number/Name: | Freedom Finance Europe Ltd |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | English |
| Original Source: | Commissioner for Personal Data Protection (in EN) |
| Initial Contributor: | Le |
The DPA reprimanded an online broker for failing to adequately explain to a data subject the reasons for not complying with their erasure request, in violation of Article 12(4) GDPR.
English Summary
Facts
The controller is Freedom Finance Europe Ltd, operating under the Freedom24 brand. It is an online investment banking firm that assists clients in investing in the stock market, whose main establishment is in Cyprus.
In November 2022, the data subject submitted an erasure request to Freedom Finance Germany TT GmbH, a subsidiary of the controller located in Germany. He requested the cancellation of his account, the erasure of his data and to stop receiving advertising emails from the controller. On the same day the data subject received a reply from customer support informing him that he would need to log into his account for identification in order to proceed with the closure of his account. The data subject contacted the controller again, demanding the deletion without logging in to his account, but he did not receive another reply and his account was not deleted; rather, he was still receiving relevant emails.
The data subject lodged a complaint with the Berlin DPA (Data Protection Authority for the German state of Berlin- BlnBDI) regarding the controller’s failure to comply with his erasure request. The complaint was subsequently transmitted to the Cypriot DPA (Commissioner for Personal Data Protection), as the supervisory authority of the main establishment of the controller (lead authority), pursuant to Article 56 GDPR.
The controller claimed that its response to the data subject’s request was clear and provided all necessary instructions for the identification process in order to cancel his account. The data subject’s second request was similar to the first one so there was no need to provide the same response. In any case, this process was clearly described in its general terms of business which the data subject had accepted. Furthermore, the controller claimed that on February 2024 it closed the data subject’s account and sent him a notification email, including the information relating to GDPR on the retention of personal data for 7 years.
Holding
The DPA stated that the controller justifiably requested the data subject to follow the procedure described above in order to verify his identity, under Article 12(2) GDPR.
However, the DPA held that from the controller’s response it was not clear whether the data subject was obligated to follow this procedure or if there was an alternative way of satisfying his request, in violation of Article 12(4) GDPR. The controller should have included a statement in its first response making it clear to the data subject that his request would not be satisfied if the relevant procedure is not followed.
The DPA took into account the fact that the controller proceeded with the closure of the data subject’s account after the DPA had contacted it regarding the complaint.
In view of the above, the DPA decided to issue a reprimand to the controller for the infringement of Article 12(4) GDPR. It also ordered it to review the information provided to data subjects when exercising their rights and inform the DPA within one month.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
