Ambitious People Group – €6,000 Fine (Netherlands, 2020)

The controller, Ambitious People Group (“APG”) is a recruitment agency. To match jobseekers with a suitable job, the controller asked for the name, address, email address, phone number, date of birth and CV of the jobseeker and stored this in a database. After finding a relevant vacancy, the controller would contact the jobseeker via e-mail. The controller operated under five different labels that each focus on a specific market: LMH, SAM, Four Life Sciences, Ardekay and Five Finance. On 30 November 2018, the Dutch DPA ("Autoriteit Persoonsgegevens") received a complaint by three data subject against the controller for failing to comply with their requests for erasure. Even after multiple erasure requests, the three data subjects received e-mails from the controller with open vacancies. Data subject 1 first requested erasure on 15 November 2018 and still received e-mails from the controller's label SAM with vacancies on 28 November 2018. Even after a second erasure request on 28 November 2018, data subject 1 still received an email with vacancies from the controller on 10 January 2019. Data subject 2 received an email on 26 March 2018 from the controller's label LMH Engineering with a vacancy. Data subject 2 requested erasure on the same day. On 30 November 2018, data subject 2 still received an email from the controller. On the same day, data subject 2 requested erasure again. On 19 February 2019, data subject 2 still received an email with a vacancy from the controller. Data subject 3 received an email on 17 October from the controller's label Five Finance with a vacancy. Data subject 3 requested erasure on the same day, also for the controller's label LMH Engineering. The controller replied on 19 October 2018 that this was a one-time non-recurring e-mail. Data subject 3 replied on the same day with another erasure request, which was confirmed by the controller on the day itself. However, data subject 3 still received an e-mail with a vacancy on 20 March 2019 and 1 August 2019 from the controller's label LMH Engineering. The DPA started an investigation to review the possible violation by the controller and thereby send information requests to the controller. The controller confirmed that they erased the personal data of the three data subjects on 11 September 2019, and informed the data subjects the next day about this erasure via e-mail. Furthermore, the controller explained to the DPA that individuals can request erasure via a designated email address provided in their privacy policy. The requests of the three data subjects were not made to their designated email address, but to the recruiters themselves who send the data subjects emails with vacancies. The controller has since then updated their internal procedure so that erasure requests send to recruiters are also forwarded to the designated email address that handles erasure requests. The DPA held that under Article 17(1) GDPR read together with Article 12(3) GDPR the controller needed to comply with erasure requests without undue delay and in any event within one month of receipt of the requests. According to the DPA, the fact that the data subjects did not use the designated email address, but the email address of the recruiter that approached them, does not change the controller’s duty to comply. The DPA noted that it also did not detract from the severity of the violation. The DPA also stated that the controller bears responsibility for the actions of its employees who, in this case, failed to respond to the erasure requests. This responsibility includes preventing human mistakes. Although the controller had complied with more than 650 erasure requests and only three incidents occurred due to human mistake, the DPA held that it did not excuse the controller from its responsibility. The DPA took into account the fact that the failure of complying with the erasure requests was most probably a human mistake of one of the controller’s employees, the fact that the controller described in detail how to handle (erasure) requests and GDPR-related complaints they receive in their personal inbox or via telephone, and the fact that the controller has now strengthened its policy regarding (erasure) requests to prevent cases like this in the future. Therefore, the DPA found the €130,000 base fine of the [https://wetten.overheid.nl/BWBR0041994/2019-03-15 Dutch Fining Policy Rules 2019] disproportionately high. As a consequence, the DPA only issued a fine of €6,000 on the grounds of Article 58(2)(i) GDPR and Article 83(4) GDPR.