GOKOAN EDUCATION, S. L. – Complaint Upheld (Spain, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
GOKOAN EDUCATION refused to delete a user's study data without seeing their ID, even though they didn't ask for it when the user signed up. Spain's data authority said this was unnecessary since the user used the same email for the request. The company must now erase the data without needing the ID.
What happened
GOKOAN EDUCATION refused to delete a user's study data without verifying their identity with an ID card.
Who was affected
The user who requested the deletion of their study and educational data.
What the authority found
The Spanish authority decided that GOKOAN EDUCATION should not require an ID card to delete data when the user had already provided their email for the service.
Why this matters
This decision highlights that companies should not impose unnecessary identity checks when users request data deletion. Businesses should ensure their data handling practices respect user rights without creating extra hurdles.
GDPR Articles Cited
A complainant asked a controller to erase all the personal data related to them. This included study and educational data and the subscription to a newsletter. The controller accepted to erase the data related to the newsletter, therefore stopping such processing, but refused to delete the study and educational data without proof of the data subject identity, asking for their national ID card in order to verify it, with grounds in Article 12(6) GDPR. The AEPD held that, given that the controller had not asked for their national ID card when obtaining the complainant's data, it was not necessary to ask for it for the exercise of their rights. The authority argued that there were no doubts regarding the identity of the data subject, as they had signed up for the services of the controller, and therefore provided their data, using the same email account used to lodge the erasure request. Hence, the AEPD ordered the controller to comply with the erasure request without further requirements to the data subject.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for GOKOAN EDUCATION, S. L. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. GOKOAN EDUCATION, S. L. - Spain (2021). Retrieved from cookiefines.eu
Last updated: