Failure of an airline company to inform the data subject of completion of erasure request

Failure of an airline company to inform the data subject of completion of erasure request and failure of transparency obligations resulted in the imposition of a fine equal to EUR 13,244.

The Data Subject lodged her complaint with the Polish SA stating that she requested the data controller to erase all her personal data in the online interface provided by the data controller on 23 October 2018. In previous cases it has already been identified that the Hungarian SA is the LSA for the data controller, therefore case has been transferred. 

Based on the data controller’s statement and the screenshot made by it on the relevant part of the IT system used to administer erasure requests, the data controller erased the Data Subject’s account on 23 November 2018, but failed to inform the Data Subject thereof prior to 6 March 2019. 

The Hungarian SA founded that the data controller infringed Article 12(3) GDPR because it failed to inform the Data Subject of the action taken based on the request within the time limit and it also infringed the principle of transparent data processing according to Article 5(1)(a) GDPR as the Data Subject could not see what additional data, for what purpose and on what legal basis and for how long were processed by the data controller in relation to her following the erasure of her account and the related personal data. 

The Hungarian SA has also found that Article 5(2) GDPR cannot be regarded as a provision requiring mandatory processing. The Hungarian SA found that that the processing pursued by the data controller in the course of legal procedures related to data subjects cannot be based on the data controller’s legitimate interest, because the balancing test wasn’t appropriate.

The Hungarian SA founded that the data controller has infringed the principle of transparency under Article 5(1)(a) and Article 12(3) GDPR. Further, the Hungarian SA established that the data controller has infringed Article 6(1) and Article 17(1)(a) GDPR. Further, the Hungarian SA ordered the data controller pursuant to Article 58(2)(g) GDPR, to erase the personal data processed for the purpose of recording the Data Subject's activities in relation to the exercise of her data protection rights.

For the infringement described above, based on Article 83(2)(i) GDPR the Hungarian SA ordered the data controller to pay a fine of HUF 5,000,000, which is approximately equal to EUR 13,244. (source: edpb.europa.eu/ photo freepik.com)

Comments

Post a Comment

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld her find
Read more

Graduate Programme 2024 for EU Nationals in European Central Bank

Image
European Central Bank (ECB) is looking for 15 highly talented recent graduates with a postgraduate degree, eventually a PhD, for the ECB’s Graduate Programme offering full time monthly net salary €4,611 plus benefits. General Information  Type of contract: Two-year fixed-term contract starting on 1 September. It may be extended for one additional year upon successful completion of the programme. Who can apply?  EU nationals Salary  E/F (bracket 1 - step 1) full time monthly net salary: €4,611 plus benefits, for further information see  here . Working time:  Full time Place of work:  Frankfurt am Main, Germany Closing date:  21.02.2024 ECB is looking for 15 highly talented recent graduates with a postgraduate degree, eventually a PhD, for the ECB’s Graduate Programme.  You will have different ages, backgrounds and interests and will find intellectual challenges, varied opportunities and a people-centred working culture that gives you a voice and the chance to make an i
Read more

The Lawyer's right to refuse the defense of an accused person for ethical reasons

Image
by Giorgos Kazoleas, Lawyer LL.M. Lawyers have the right to refuse to undertake a case when it conflicts with their moral principles, their dignity and conscience. Both the Code of Lawyers in Greece and the Code of Lawyers 'Ethics in Cyprus provide the legal framework to support this choice.   The Greek Legislation The lawyer's right to refuse the defense of a specific defendant in a criminal trial clearly follows from the wording of article 37 of the Lawyers' Code (Law 4194/2013). According to paragraph 1 of this article, the lawyer has an obligation to undertake any case, unless it is manifestly unfounded, not amenable to defense, conflicts with the interests of other clients or goes against his/her principles. According to paragraph 2, the lawyer must undertake the defense of any accused, if requested by the judicial authorities, subject to paragraph 1. The reasons for refusing to undertake a case are expanded by article 6 of the Greek Code of Ethics of the Legal Pro
Read more

The name Pablo Escobar may not be registered as an EU trade mark

Image
According to the Judgment of the General Court in Case T-255/23 (Escobar v EUIPO) the name Pablo Escobar may not be registered as an EU trade mark. The public would associate that name with drug trafficking and narco-terrorism.  On 30 September 2021, Escobar Inc., established in Puerto Rico (United States), filed an application with the European Union Intellectual Property Office (EUIPO) for registration of the word sign Pablo Escobar as an EU trade mark for a wide range of goods and services.  The Colombian national named Pablo Escobar, who was born on 1 December 1949 and died on 2 December 1993, is presumed to be a drug lord and a narco-terrorist who founded and was the sole leader of the Medellín cartel (Colombia).  EUIPO rejected the application for registration on the ground that the mark was contrary to public policy and to accepted principles of morality. It relied on the perception of the Spanish public, as it is the most familiar with Pablo Escobar due to the links between Spa
Read more

Gigantic fine for unfair practices imposed on Booking.com by the Competition Authority of Hungary

Image
One of the highest fines for violation of unfair competition law has been imposed (28/4/2020) on online hotel booking platform ‘’Booking.com’’ by the Hungarian Competition Authority. The amount of the fine (approximately EUR 6 million / HUF 2.5 billion) imposed by the Authority illustrates the seriousness of the Dutch company's violations. The Hungarian Competition Authority (GVH) imposed a fine of HUF 2.5 billion on the operator of the online booking portal booking.com, and at the same time banned the Dutch company from continuing its aggressive sales methods. According to the decision of the competition authority, Booking.com B.V. engaged in unfair commercial practices against consumers by, among other things, misleadingly advertising some of its accommodations with a free cancellation option and exerting undue psychological pressure on consumers to make early bookings. As a result of the Competition Authority’s competition supervision proceeding  initiated in 2018, the autho
Read more

First judgment of the ECHR: Lawless v. Ireland

Image
60 years ago, on 14 November 1960, the Court delivered its first judgment, Lawless v. Ireland, with René Cassin as its President. The judgment concerned preliminary objections and procedural questions regarding the application, on which a judgment on the merits was delivered the following year. Since its inauguration the Court has delivered 23,291 judgments on just over 51,650 applications. The case was filed by Gerard Richard Lawless, who had been an IRA member, although he claimed to have left the IRA. He was arrested on 11 July 1957, as he was about to travel to Great Britain from Ireland, and subsequently detained under the special powers of indefinite detention without trial under the Offences against the State (Amendment) Act 1940. The case was filed by Lawless for violation, by the Irish Government, of Articles 5, 6 and 7 of the European Convention of Human Rights, providing rights to liberty and security, fair trial and the principle of 'no punishment without law'
Read more

Nepotism and favouritism in the legal profession

Image
by Giorgos Kazoleas, Lawyer Nepotism in the legal profession is not only a domestic but a global phenomenon with timeless characteristics. Lack of meritocracy and favouritism during the process of recruitment and professional development of lawyers have common sources of nepotism and clientelism. Even in countries with advanced legal systems, such as the USA, the phenomenon of placing relatives and friends in high positions in law firms is very common. In the southern countries of Europe, nepotism stems mainly from family-oriented concepts deeply rooted in the subconscious of the societies. In smaller populated countries the phenomenon of employers' relatives and friends being preferred for jobs in law firms is more than common. In countries like India, the phenomenon of nepotism in the legal profession has particularly concerned the legal community, as there is a stronghold of a few privileged and powerful families which prevails  in the legal profession. Among lawyers and jud
Read more