View source for DPC - C-XX-X-XX Groupon International Limited - December 2020

{{DPAdecisionBOX

|Jurisdiction=Ireland
|DPA-BG-Color=background-color:#013d35;
|DPAlogo=LogoIE.png
|DPA_Abbrevation=DPC
|DPA_With_Country=DPC (Ireland)

|Case_Number_Name=C-XX-X-XX Groupon International Limited - December 2020
|ECLI=

|Original_Source_Name_1=Data Protection Commission
|Original_Source_Link_1=https://www.dataprotection.ie/sites/default/files/uploads/2021-02/16.12.2020_Decision_Complaint_GrouponInternationalLimited.pdf
|Original_Source_Language_1=English
|Original_Source_Language__Code_1=EN

|Type=Complaint
|Outcome=Partly Upheld
|Date_Decided=16.12.2020
|Date_Published=
|Year=2020
|Fine=None
|Currency=

|GDPR_Article_1=Article 5(1)(c) GDPR
|GDPR_Article_Link_1=Article 5 GDPR#1c
|GDPR_Article_2=Article 6(1) GDPR
|GDPR_Article_Link_2=Article 6 GDPR#1
|GDPR_Article_3=Article 12(2) GDPR
|GDPR_Article_Link_3=Article 12 GDPR#2
|GDPR_Article_4=Article 12(6) GDPR
|GDPR_Article_Link_4=Article 12 GDPR#6
|GDPR_Article_5=Article 17(1) GDPR
|GDPR_Article_Link_5=Article 17 GDPR#1
|GDPR_Article_6=Article 60(2) GDPR
|GDPR_Article_Link_6=Article 60 GDPR#2
|GDPR_Article_7=Article 60(3) GDPR
|GDPR_Article_Link_7=Article 60 GDPR#3
|GDPR_Article_8=Article 60(4) GDPR
|GDPR_Article_Link_8=Article 60 GDPR#4


|National_Law_Name_1=Section 109(2)
|National_Law_Link_1=http://www.irishstatutebook.ie/eli/2018/act/7/section/109/enacted/en/html

|Party_Name_1=Groupon International Limited
|Party_Link_1=https://www.groupon.ie/
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=Cellular
|
}}

The Irish DPA found that Groupon infringed the principle of data minimisation (Article 5(1)(c) GDPR) by requiring the complainant to verify their identity by submitting a copy of a national ID document when a less data-driven solution to the question of identity verification was available. The DPC also found that Groupon infringed Articles 12(2),17(1)(a) and 6(1) GDPR. 

==English Summary==

===Facts===
Acting in its capacity as lead supervisory authority, the Irish DPA (DPC) commenced an examination of a complaint originally received by the Polish DPA. The complaint concerned cross-border processing in which the DPC was competent to act as lead SA.

This complaint concerned Groupon’s practice at the time of the complaint of requiring data subjects to verify their identity with an electronic copy of a national identity card. This requirement applied when data subjects made certain requests, including requests for erasure of personal data, but the requirement did not apply when data subjects created a Groupon account.
===Holding===
The decision found that Groupon infringed the principle of data minimisation in Article 5(1)(c) GDPR by requiring the complainant to verify their identity by submitting a copy of a national ID document in circumstances where a less data-driven solution to the question of identity verification (namely by way of confirmation of email address) was available to Groupon.

The decision also found that Groupon infringed Articles 12(2),17(1)(a) and 6(1) in the circumstances of the complainant’s case.

The decision also reprimanded Groupon in respect of the infringements.

==Comment==
''Share your comments here!''

==Further Resources==
''Share blogs or news articles here!''

==English Machine Translation of the Decision==
The decision below is a machine translation of the English original. Please refer to the English original for more details.

<pre>

</pre>