DPA case 62334 (IMI Case) – Complaint Upheld (Germany, 2021)

The data subject created an account with the controller. During the account creation, he used the name of his mother as an account name and an incorrect date of birth, which enabled him circumvent him age restriction of the service. Regarding the account name, he was not obliged to use a real name but was free to choose any Pseudonym he wanted use. After the data subject reached the age of majority, he requested the correction of the account name as well as the date of birth from the controller. As the customer support of the controller rejected the request, the data subject filed a complaint with the French DPA (CNIL) claiming that his right to rectification under Article 16 GDPR had been violated. The HBDI partly upheld the complaint, stating that the refusal of the controller to change the date of birth constituted a violation of the data subject's right to rectification. The HDBI, however, found no violation of Article 16 GDPR in relation to the account name, because as a pseudonym can never be incorrect. The HBDI issued a warning against the controller pursuant to Article 58(2)(b) GDPR and urged it to improve their customer support so that these kind of claims will not be wrongly rejected again in the future.