- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
GOKOAN EDUCATION, S. L. – Complaint Upheld (Spain, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
GOKOAN EDUCATION had to erase a complainant's personal data but asked for their ID to confirm their identity. The Spanish data protection authority decided this was unnecessary since the complainant had already provided their information. This case highlights that companies should not impose extra requirements when someone requests their data to be deleted.
What happened
GOKOAN EDUCATION refused to delete a complainant's educational data without proof of identity.
Who was affected
The complainant who requested the deletion of their personal data held by GOKOAN EDUCATION.
What the authority found
The authority ruled that GOKOAN EDUCATION could not require an ID for the erasure request, as it had not asked for it when collecting the data.
Why this matters
This ruling emphasizes that companies must make it easier for users to exercise their rights regarding personal data. It sets a precedent for how companies handle deletion requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A complainant asked a controller to erase all the personal data related to them. This included study and educational data and the subscription to a newsletter. The controller accepted to erase the data related to the newsletter, therefore stopping such processing, but refused to delete the study and educational data without proof of the data subject identity, asking for their national ID card in order to verify it, with grounds in Article 12(6) GDPR. The AEPD held that, given that the controller had not asked for their national ID card when obtaining the complainant's data, it was not necessary to ask for it for the exercise of their rights. The authority argued that there were no doubts regarding the identity of the data subject, as they had signed up for the services of the controller, and therefore provided their data, using the same email account used to lodge the erasure request. Hence, the AEPD ordered the controller to comply with the erasure request without further requirements to the data subject.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for GOKOAN EDUCATION, S. L. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. GOKOAN EDUCATION, S. L. - Spain (2021). Retrieved from cookiefines.eu
Last updated: