Court case 45717 – Court Ruling (Luxembourg, 2023)

A data subject found that an American company (controller) had collected personal data about him and was marketing it on its website. The data subject contacted the controller about this, who responded with an automated message asking him to fill in an identity verification form in order to process his request. On 8 July 2020, the data subject requested the Luxembourg DPA to order the controller to comply with his request. He believed that the controller had violated Article 15 GDPR for not handling his access request correctly and 27 GDPR for not having an establishment in the EU. The DPA asked the data subject to provide correspondence with the controller. In August 2020, the DPA informed the data subject that it would no longer deal with his request as the controller was US based and the DPA therefore had no power to impose measures under the GDPR. The data subject insisted that the controller offered services on the internet and that a simple search via a search engine would find his personal data on the controller's website. He also asked why the DPA felt it did not have the authority to investigate in the US. On 16 October 2020, the DPA replied by letter that it had contacted the controller but that without its response it was impossible to proceed. It also repeated that it had no means of action against a US based controller. The data subject, represented by noyb, appealed this decision of the DPA to the administrative Court (hereafter the Court) to have the DPA's letter reversed or annulled. He considered that he had a standing to act under Article 78 GDPR, especially since his data was still present on the controller's site. He argued he was therefore damaged by the DPA's decision not to pursue with his request. The data subject also argued that the DPA had violated Article 77 GDPR. Finally, he explained that the controller did not provide a copy of his access request, reason why he could not provide this document. First, the Court considered that the data subject only submitted the controller's automatic reply and not the rest of the correspondence, which prevented the Court from knowing the content of his request. Second, with regard to the handling of the complaint, the Court considered that the DPA requested additional information from the data subject and communicated with him by email. It also provided explanations for not pursuing its examination. It therefore de facto dealt with the complaint and did not violate Article 77 GDPR. The Court added that Article 57(f) GDPR does not impose on the DPA an obligation to open an investigation or use its enforcement powers as soon as a controller is the subject of a complaint. The Court therefore considered that the case had to be analysed under Article 78 GDPR. In this respect the court considered that the DPA letter informing the data subject that it would not initiate proceedings against the controller was not directly affecting the personal and financial situation of the data subject. Since the data subject did not provide enough documents to prove his request to the controller, his complaint with the DPA was limited to asking the DPA to request in his place information under Article 15 GDPR. According to the Court, the data subject retained his rights under Article 15 GDPR, thus, he did not suffer any damage from the refusal of the DPA. The Court added that under Article 79 GDPR, a prior referral to the competent supervisory authority is not a condition to obtain compensation for damages resulting from the violation of data protection. Third, regarding the violations by the controller, concerning Article 27 GDPR, the Court considered that the fact that the controller did not have an establishment in the EU did not constitute a violation of the data subjects right to data protection but could only constitute an obstacle to the exercise of his rights. As for Article 15 GDPR, the Court considered that the data subject did not prove that he was prevented from exercising his rights. The automatic response of the controller indeed included an email address he could have contacted. According to the Court, it implied that the data subject could not rely on a violation of Articles 15 and 27 GDPR which would be perpetuated by the refusal of the DPA to intervene. In conclusion, the Court held that the refusal of the DPA to intervene did not cause a violation of a personal right of the data subject. The action was therefore inadmissible for lack of standing.