MAG Interactive AB – Complaint Upheld (Sweden, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Sweden's privacy authority upheld a complaint against MAG Interactive AB for not properly handling a user's request to delete their game data. The company asked for extra information even though the user provided enough details to identify their account. This case shows that companies must make it easy for users to exercise their data rights.
What happened
MAG Interactive AB failed to process a user's request to erase their game data, asking for unnecessary additional information.
Who was affected
A user who played the game QuizDuel and requested data erasure was affected.
What the authority found
The Swedish authority found that the company did not comply with GDPR requirements for handling data erasure requests, as they made the process unnecessarily difficult.
Why this matters
This decision highlights the importance of simplifying data rights processes for users. Companies should ensure their systems can handle data requests efficiently without burdening users with extra requirements.
GDPR Articles Cited
A data subject in France requested the erasure of their personal data in the game QuizDuel by MAG Interactive AB (“controller”), a mobile gaming company based in Sweden. The data subject logged into the game via their Facebook account. The controller replied with requesting additional information from the data subject for identification purposes, even though the data subject had provided their Facebook ID and email addresses in their request for erasure. The controller explained that neither the Facebook ID and the three email addresses the data subject provided in their erasure request resulted in any hits on a direct search in the controller’s system. The controller furthermore explained that the easiest way for the data subject to request erasure was by downloading the game again and request erasure within the game. The data subject responded that they no longer had an account. The controller then requested the following information to restore the data subject’s account and to enable the data subject to request the erasure of his personal data: (1) the username, (2) names of three friends, (3) names of three opponents and (4) an email address to link the account with. The data subject replied and requested access to the information the controller had about them. The controller again informed the data subject it could not find the data subject’s account with the data subject’s Facebook ID and stated that the data subject could request access to personal data from within a game of the controller. The data subject replied that they had played the game “QuizDual” on Facebook and did not have an account with the controller and therefore could not request access from the account. The controller argued that the game never existed on Facebook but that the data subject may have logged in via a Facebook on a mobile application. However, as the data subject for the first time mentioned the game, the controller could use the game information to locate an account linked to
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for MAG Interactive AB in SE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. MAG Interactive AB - Sweden (2023). Retrieved from cookiefines.eu
Last updated: