DPA case 6FR/2023 – €5,330 Fine (Luxembourg, 2023)

On 10 March 2021, the Luxembourg DPA received a complaint from the data subject regarding the publication of her data on Company X’s website, despite not being a subscriber of Company X. In the course of investigating the complaint concerning Company X, it became apparent to the Luxembourg DPA that several other companies were involved – Companies A and B. Company B, who the data subject had been a subscriber of, had transferred the data to Company A, which then transferred it to Company X. Relationship Between Companies A, B, and X As a result of these findings, on 1 July 2022, the Luxembourg DPA opened investigations into Companies A and B, as well as Company X. Through this inquiry, it was discovered that Company A was a subcontractor for Company B, responsible for “managing/ modifying/ deleting” Company B’s subscriber list. While Company A and B did not share a common customer file or computer system, under their subcontracting agreement, members of Company A had access to Company B’s computer system to carry out processing operations. These operations included generating a file on a monthly basis with the customers wishing to appear on Company X’s website. The Data Subject’s Relationship with Companies A, B, and X The data subject signed a subscription contract with company B on 27 April 2015, which ended on 30 June 2019. The data subject first became aware that Company X had access to her data in October 2020. During this time, she received a telephone call for religious canvassing, and was made aware that her data had been transferred from Company B to Company X. Following this, on 19 October 2020, she requested that her data be deleted from their database. Company X confirmed that they would do so. Company X sent a request on the same day to Company A (Company B’s processor) to erase the data subject’s data. However, on 10 March 2021, the data subject’s data was once again made available on Company X’s website. When she objected to this, Company X noted