HBDI (Hesse) - 62334 (IMI Case)
|HBDI - 62334 (IMI Case)|
|Relevant Law:||Article 16 GDPR|
Article 58(2)(b) GDPR
Article 60 GDPR
|National Case Number/Name:||62334 (IMI Case)|
|European Case Law Identifier:||EDPBI:DEHE:OSS:D:2021:296|
|Original Source:||EDPB (in EN)|
The Hessian DPA (HBDI) held that a data subject has a right to rectification under Article 16 GDPR, even if he or she purposefully provided incorrect information during the account creation in order to circumvent age restrictions.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject created an account with the controller. During the account creation, he used the name of his mother as an account name and an incorrect date of birth, which enabled him circumvent him age restriction of the service. Regarding the account name, he was not obliged to use a real name but was free to choose any Pseudonym he wanted use. After the data subject reached the age of majority, he requested the correction of the account name as well as the date of birth from the controller. As the customer support of the controller rejected the request, the data subject filed a complaint with the French DPA (CNIL) claiming that his right to rectification under Article 16 GDPR had been violated.
Holding[edit | edit source]
The HBDI partly upheld the complaint, stating that the refusal of the controller to change the date of birth constituted a violation of the data subject's right to rectification. The HDBI, however, found no violation of Article 16 GDPR in relation to the account name, because as a pseudonym can never be incorrect. The HBDI issued a warning against the controller pursuant to Article 58(2)(b) GDPR and urged it to improve their customer support so that these kind of claims will not be wrongly rejected again in the future.
Comment[edit | edit source]
The decision concerns a cross-border case with the HBDI acting as the lead supervisory authority and the CNIL as an authority concerned under the cooperation procedure of Article 60 GDPR.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the English original. Please refer to the English original for more details.
THE HESSIAN COMMISSIONER FOR DATA PROTECTION AND FREEDOM OF INFORMATION 19 November 2021 Final Decision Complaint against – Right to rectification (Article 16 GDPR) IMI Case: 62334 IMI A61VMN: 312886 IMI A60DD: 330086 The Hessian Commissioner for Data Protection and Freedom of Information (hereinaf- ter “HBDI”) refers to the complaint lodged by Mr. L. G. (hereinafter “Complainant”) against (hereinafter “ ”) with the French Data Pro- tection Authority concerning the right to rectification. 1. Case Description The Complainant, who was born on 2001, created an account with in 2014. In order to circumvent restrictions that would have been associated with a minor's account, he untruthfully stated 1996 as his date of birth. As an account name, which he was free to choose, the Complainant chose the pseudonym " ", the name being his mother's first name. After the Complainant had reached the age of majority, he requested the correction of the account name and the date of birth stored by . refused both, which is why the Complainant lodged a complaint with the French DPA. 2. Investigation outcome With regard to the account name, there is no entitlement to rectification. A pseudonym freely chosen by the data subject cannot be incorrect within the meaning of Article 16(1) GDPR, even if it may contain names or other data of third parties. Regarding the rejected correction of the date of birth, was asked by the HBDI to comment. replied that the correction had been rejected by the customer support because the provision of a false date of birth when creating an account violates the user contract. Depending on the age of the account holder, would provide different functions and services. In addition, the request and storage of the date of birth serves the fulfilment of legal obligations. Since a subsequent change of the date of birth can have far-reaching consequences, users cannot change it themselves. This is Page 1 of 2 ____________________________________________________________________________________________________ Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01) Email email@example.com Web www.datenschutz.hessen.de, Draft Decision – IMI Case 62334 ____________________________________________________________________________________________________ also pointed out to users when they create an account. Requests to change the date of birth would be examined more closely by with regard to possible conse- quences. After reviewing the facts, the Complainant's date of birth would now be changed and he would be informed accordingly. This case was also taken as an op- portunity to review the processes in the customer support and to adjust the underlying work instructions. 3. Decision In its Draft Decision of 07 October 2021, the HBDI has informed the supervisory au- thorities concerned that it intends to issue a warning to pursuant to Arti- cle 58(2)(b) GDPR, as the correction of the Complainant’s date of birth was initially improperly refused by ’s customer support. The right to rectification exists re- gardless of possible consequences under civil law in the contractual relationship be- tween and the Complainant. Accordingly, the processes in customer support must be adapted so that a correction is not generalized rejected in future, comparable cases. The HBDI found that further measures or sanctions are not necessary, as has already initiated the rectification of the Complainant's date of birth as well as the adjustment of the work instructions on its own initiative. Moreover, the Com- plainant himself was responsible for the reason for the necessary correction by delib- erately providing false information. No objections to the Draft Decision were raised by the supervisory authorities concerned. The HBDI therefore issued a warning to and concludes the proceedings with this Final Decision. The Hessian DPA ____________________________________________________________________________________________________ Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01) Email firstname.lastname@example.org Web www.datenschutz.hessen.de