DSB - DSB-D122.970/0004-DSB/2019
|DSB (Austria) - DSB-D122.970/0004-DSB/2019|
|Relevant Law:||Article 17 GDPR|
|National Case Number/Name:||DSB-D122.970/0004-DSB/2019|
|European Case Law Identifier:||ECLI:AT:DSB:2019:DSB.D122.970.0004.DSB.2019|
|Original Source:||RIS (in DE)|
The DSB issued a decision related to the righ to be forgotten: to exercise this right, the controller may not require more data than the ones previously asked to the data subject.
English Summary[edit | edit source]
Facts[edit | edit source]
An online user has registered with his own email address and his wife's first name on a webpage. Despite the fact that no further information was required by the page, he added the gender "female" bis ZIP code and a phone number. Later, he requested the account to be deleted.
While assessing the deletion request, the controller realised that the name and gender of the user did not match with the data provided. Thus, the controller asked the data subject to fill out a form (that was provided on the webpage of the Austrian DPA) and required to provide further data and to sign it as a form of identification.
Being unhappy with these adaptational request of information, the data subject filed a complaint with the DSB.
Dispute[edit | edit source]
Can a controller require further information for verification purposes, if the controller has no internal data to match it with?
Holding[edit | edit source]
In the view of the DSB the controller of the webpage has de facto allowed pseudononymous profiles, as users only need to provide a valid email, but may choose any unverified first name they wish to use (here a female first name).
The controller may not require more than the previously provided data to verify a data subject (here the email and for example the password).
Therefore, the complainant's right to erasure was violated. The controller was ordered to delete the data. No fine was issued.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the original. Please refer to the German original for more details.