26/11/2019Examination of complaint vs Marikit Holdings Ltd (22bet.com) –
right to erasure under the GDPR and information to be provided to the data subject
Broadcast date:
12/11/2019
Summary of the Decision
Origin of the case
The complainant alleged that after opening an account on the controller’s website to participate in a competition, he was not given the possibility to exercise his right to erasure and delete his account. When the complainant contacted the controller to request the erasure of his account, the controller initially replied that deletion was not possible, proposing to block the account for one year instead.
Findings
In its initial reply to the LSA, the controller alleged that the data subject could not be identified as s/he did not provide the relevant email address. Subsequently, the controller informed the LSA that it would retain the data until it would be reasonably sure that such data would not need to be produced as supporting evidence before regulatory bodies, which could request data for a wide range of purposes. The erasure request was eventually granted after verification that deleting the complainant’s personal data would not lead to an infringement of other legal obligations.
In addition, the LSA found that the information provided to the data subjects in the privacy policy was insufficient to facilitate the exercise of their rights.
Decision
Since the controller reacted to the erasure request within the timeframe provided in the GDPR and eventually granted it, the LSA found that no corrective measures should be imposed.
Nevertheless, the LSA ordered the controller to revise their privacy policy accordingly and to inform the LSA of the revision.