Background information
- Date of final decision: 08 October 2020
- Cross-border case
- ”One-Stop-Shop Procedure: the decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS)
- LSA: HU SA
- and CSAs: RO SA
- Controller: A company operating an online webshop.
Legal Reference(s): Article 17 (Right to erasure (‘right to be forgotten’)) - Decision: Dismissal of the case
- Key words: Newsletter, Right to erasure
Summary of the Decision
Origin of the case
On 11 March 2019, the Complainant lodged a complaint by e-mail with the Romanian data protection authority concerning an unsuccessful unsubscribe from a newsletter and unrequested e-mails with the direct purpose of acquiring business. As this involved the cross-border processing of personal data, an Internal Market System (IMI) procedure was launched in accordance with Article 56 (1) of GDPR with a view to identifying the lead supervisory authority, in which NAIH as the authority competent according to the registered offices of the controller identified itself as the lead supervisory authority.
In the complaint the Complainant presented that he lodged the complaint with the controller on 3 December 2018 stating that he was unable to unsubscribe from the newsletter because the relevant link did not function and he alleged that despite his request, he continued to receive weekly newsletters from the controller.
Key Findings
The information made available to the Hungarian Supervisory Authority (HU SA) did not substantiate that the Complainant continued to receive newsletters after 30 days following the submission of the unsubscribe request because the date of sending the newsletters cannot be seen in the documents submitted by the Complainant.
Furthermore, it could not be established whether the Complainant had requested the erasure of his personal data from the controller, or he has only tried to unsubscribe from the newsletter unsuccessfully. Hence, the HU SA sent questions to the Complainant on 5 December 2019 with a 10-day period open for responding. The HU SA did not receive an answer to its questions from the Complainant. As it was not substantiated that the Complainant also submitted an erasure request according to Chapter III of GDPR, the competence of the HU SA could not be established as with respect to the unsubscribe itself it has no jurisdiction according to the rules of Hungarian law.
Decision
Pursuant to Section 16/B of Act CVIII of 2001 concerning electronic commercial services and certain issues of services related to the information society, the investigation of the complaint related to sending newsletters and the unsuccessful unsubscribe from the newsletter is within the powers of the Nemzeti Média- és Hírközlési Hatóság (NMHH - Hungarian National Authority for Media and Telecommunications). Thus, the HU SA had no power to take action in this respect. In view of the above, the HU SA informed the complainant that, based on the available data, the HU SA was not competent to take action as the only point that could be established on the basis of the complaint was that the request concerned his failed attempt to unsubscribe.
For this reason, the HU SA regarded the procedure as closed and transferred the complaint to the NMHH on 8 October 2020.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.