DPA case EXP202315744 – Dismissed (Spain, 2024)

On 10 May 2019, the data subject consented to the processing of his personal data for the use of captured image in activities and interviews to be published in Gabinete de Neurociencias S.L.'s (the controller) social networks and websites to disseminate the sporting activities. On 7 February 2023, the data subject exercised his right of objection and withdrew his consent for the use of his personal images, claiming that on 30 March 2023, his images still appeared in the claimed company social media. The controller argued that they attempted to address the request appropriately and that technical and communication issues with Meta (the company behind the social networks used) prevented the timely deletion of the image. Despite their efforts, including multiple attempts to contact and requests for assistance from META, the corporate account in question could not be recovered or modified in time. The Spanish DPA (AEPD) dismissed the complaint because the data controller did respond to the data subject’s request, complying with the applicable deadlines stipulated by GDPR. It found that the completeness of the request depends on META’s return. The data subject filed an appeal. The data controller reiterated their documented attempts and efforts to delete the images and communicate with Meta, arguing that despite their efforts they faced issues in fully complying with the erasure request due to Meta's nonresponsiveness. The AEPD dismissed the appeal by the data subject. It found that the data controller had responded to the erasure request and was not able to fully address the request due to technical problems with Meta. The AEPD considered that the controller had put forth considerable effort to comply with the erasure request, as evidenced by the partial deletion achieved.