DPA case CDP/IMI/LSA/17/2022 – Complaint Upheld (Malta, 2022)

The data subject requested an investment services provider (controller) to close his account and unsubscribe him from e-mail notifications. In subsequent e-mails, the controller asked the data subject to sign and return the subscription agreement, which had not been signed at the start of the subscription. The controller would close the account after the data subject signed the agreement. The data subject rejected this option and filed a complaint at the Spanish DPA which, in turn, transferred the case to the information and data protection commissioner of Malta (DPA) pursuant of Article 56 GDPR. Therefore, the LSA handled the complaint under of Article 60 GDPR and started an investigation. During the proceedings, the controller stated that it was subject to a yearly audit by an independent third party. Its processing of personal data was necessary to comply with this legal obligation. Therefore, it did not delete all the data. The controller also relied on Article 6(1)(c) GDPR for its processing. The controller also provided screenshots to prove that it closed the account of the data subject on 26 May 2020. Document containing personal data of third parties The DPA held that data subjects could only lodge complaints with a supervisory authority if the possible infringing processing concerned the data subject (Article 77(1) GDPR). This part of the complaint was dismissed since it only concerned personal data of third parties disclosed in the document. The data subject was not affected by this. However, the DPA reserved the right to start a separate investigation on this alleged data breach. The DPA proceeded to examine the erasure request and the timing of the request, pursuant of Article 57(1)(f) GDPR. Erasure request The DPA held that the controller must delete personal data without undue delay when a request is made pursuant of Article 17 GDPR. However, this is different when Article 17(3) GDPR applies, which describes that Article 17(1) and 17(2) do n