MAG Interactive AB – Complaint Upheld (Sweden, 2023)

A data subject in France requested the erasure of their personal data in the game QuizDuel by MAG Interactive AB (“controller”), a mobile gaming company based in Sweden. The data subject logged into the game via their Facebook account. The controller replied with requesting additional information from the data subject for identification purposes, even though the data subject had provided their Facebook ID and email addresses in their request for erasure. The controller explained that neither the Facebook ID and the three email addresses the data subject provided in their erasure request resulted in any hits on a direct search in the controller’s system. The controller furthermore explained that the easiest way for the data subject to request erasure was by downloading the game again and request erasure within the game. The data subject responded that they no longer had an account. The controller then requested the following information to restore the data subject’s account and to enable the data subject to request the erasure of his personal data: (1) the username, (2) names of three friends, (3) names of three opponents and (4) an email address to link the account with. The data subject replied and requested access to the information the controller had about them. The controller again informed the data subject it could not find the data subject’s account with the data subject’s Facebook ID and stated that the data subject could request access to personal data from within a game of the controller. The data subject replied that they had played the game “QuizDual” on Facebook and did not have an account with the controller and therefore could not request access from the account. The controller argued that the game never existed on Facebook but that the data subject may have logged in via a Facebook on a mobile application. However, as the data subject for the first time mentioned the game, the controller could use the game information to locate an account linked to one of the email addresses the data subject provided. The data subject then received an email to confirm they wanted their account to be erased. The data subject replied and confirmed they owned the account and they wanted it erased. The controller then erased the account and informed the data subject of the erasure. The data subject lodged a complaint against the controller at the French DPA. Given the cross-border nature of the processing, the Swedish DPA (“Integritetsskydds myndigheten”) made use of the cooperation and consistency mechanisms provided by the GDPR, as the controller was based in Sweden. The data subject asked to investigate whether the controller handled the data subject’s request for erasure correctly, whether the information that the controller requested was necessary to confirm the data subject’s identity and whether the controller sufficiently facilitated the exercise of the data subject’s rights in the GDPR. The controller argued that it was difficult to locate the personal data of the data subject, as the account of the data subject was closed for a long time and neither the email address from which the request came and the Facebook ID was linked to any account with the controller. Moreover, since Facebook changed the way Facebook ID works for privacy reasons, the number that the controller received from Facebook is only linked to the controller and not linked to an individual’s Facebook account. Firstly, regarding the information requested, the DPA assessed if the controller had reasonable grounds to doubt the identity of the data subjects. The DPA pointed out that under Article 12(6) GDPR additional information may be requested if the controller has reasonable grounds to doubt the identity of the controller. The DPA, in light of the controller’s argumentation, held that the controller had reasonable grounds to doubt the identity of the data subject. The DPA also took into account that the controller had an obligation to ensure the identity of the data subject making a request to protect the data subject against someone else wrongly making requests in their name, leading to negative consequences for the data subject. The DPA then continued and stated that even if the controller had reasonable grounds, it should carry out a proportionality assessment to justify the verification method used to not unnecessarily collect more personal data. The DPA found that at the time of the data subject’s erasure request, the controller only processed an email address linked to the data subject, the advertising ID of the data subject’s phone and the data subject’s username and password. The DPA therefore held that an erroneous deletion of the said data would not result in any major disadvantages or consequences for the data subject, and thus the requirements for identification could therefore be set relatively low. The DPA also stated that in the end, the controller was able to comply with the erasure request with only the email address linked to the user account. Thus, the DPA considered that asking for additional data in the form of the usernames of three friends and three opponents were neither necessary nor proportionate to confirm the identity of the data subject under Article 12(6) GDPR. The DPA then examined whether requiring the data subject to log into their account and make their erasure request from within the game was compatible with Article 12(2) GDPR. The [https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf EDPB guidelines on right of access (01/2022)] state that the controller may encourage the data subject to use a self-service tool, but that the controller must also deal with access requests that are not sent through the established communication channel. By requiring the data subject to log in to a game to send their requests, the controller did not facilitate in the data subject’s exercise of their right to erasure. The DPA therefore held that the controller was in breach of Article 12(2) GDPR. The DPA found that the infringements were minor pursuant to [https://gdpr-text.com/read/recital-148/ Recital 148], because (1) the infringements found date back relatively far in time and (2) the controller did fully comply with the data subject’s request for erasure. Thus, the DPA issued a reprimand to the controller for breaching Article 12(2) GDPR and Article 12(6) GDPR.