CDON AB – Complaint Upheld (Sweden, 2023)

7 data subjects separately contacted CDON AB (“controller”), a Swedish company, and made an erasure request. The controller replied that in order to process the request, it needed information on date of birth, address, customer number information on recent purchases such as order number and information on payment method including the last four digits of the credit card number in case of card payment. Several data subjects argued they could not retrieve all the requested information as their purchases were so far back in time. The data subjects lodged separate complaints against the controller in Finland (6) and Denmark (1). Given the cross-border nature of the processing, the Swedish DPA (“Integritetsskydds myndigheten”) made use of the cooperation and consistency mechanisms provided by the GDPR, as the controller was based in Sweden. The controller argued that the names and email addresses of the data subjects were not sufficient to ensure the data subject’s identity. It therefore requested additional information from the data subjects pursuant to Article 12(6) GDPR. The controller also stated it took the complaints very seriously and has since reviewed and clarified the identification process so that data subjects only need to answer one of the two security questions, and offers data subject to contact customer service for investigation of alternative security questions to verify the customer’s identity in the case of the data subject being unwilling or unable to answer the questions. Moreover, the controller stated that it deleted customer profiles automatically depending on the consumer law obligations in various countries, for example after three years in Sweden. The controller thereby confirmed that all of the data subjects’ personal data were deleted. The DPA did not investigate two out of seven complaints. The controller could not verify the receiving or processing date of those erasure requests as several years had passed since the complaints were submitted to the Finnish DPA. The DPA then noted it could not draw any firm conclusions as to what occurred in the two cases. Moreover, as the controller confirmed it did not process personal data of these two data subjects anymore, the DPA found no reason to investigate these two complaints further. Regarding the remaining five complaints, the DPA first assessed if the controller had reasonable grounds to doubt the identity of the data subjects. The DPA pointed out that under Article 12(6) GDPR additional information may be requested if the controller has reasonable grounds to doubt the identity of the controller, but must carry out a proportionality assessment first. The DPA held that randomly requiring data for identification purposes without assessing whether the data is necessary violates Article 12(6) GDPR and the principle of data minimisation under Article 5(1)(c) GDPR. The DPA then examined whether the information requested was necessary to confirm the data subjects’ identity. The DPA found that the controller had not provided sufficient support to conclude that the additional information it requested was necessary to identify the data subjects ’identity. Therefore, the DPA concluded that the controller violated Article 5(1)(c) GDPR and Article 12(6) GDPR. Moreover, the DPA further stated that the controller used a burdensome verification method when requesting erasure without justification, by for example asking the data subjects to provide the order number and price of the last order when the last order was a long time ago. The DPA held that the controller did not facilitate the exercise of the data subjects’ rights, thereby violating Article 12(2) GDPR. The DPA then examined the current practice of the controller for handling requests for erasure, since the controller had reviewed its procedures since 2018 when the complaints were received. The DPA found the existing procedure not disproportionate and thus not in violation with the GDPR. The DPA found that the violations were a minor infringement pursuant to [https://gdpr-text.com/read/recital-148/ Recital 148], because (1) the controller had taken measures to facilitate the exercise of data subjects’ rights under the GDPR and amended its practice to comply with the GDPR, (2) the infringements found occurred relatively long ago and (3) the controller had not received any corrective action for GDPR violations before. Thus, the DPA issued a reprimand to the controller for breaching Article 5(1)(c) GDPR, Article 12(2) GDPR and 12(6) GDPR.