5

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background.

During their "pre-qualification process", I had to register a separate account with one of their partners to take a test. During that phase, I decided this wasn't for me.

This is when I realized that I couldn't access the account I created with them (sign in didn't work), nor could I access my account on their partner's website (same issue).

So I wrote them an email, politely asking them to delete my account and all my personal data from their website and partner's website and to confirm to me when this would be done.

They answered that:

  1. The reason why you were not able to log into your profile is that you haven't completed the pre-qualification process yet

  2. In regards to our partner, they are a separate company from us, so I am afraid that you will have to discuss this issue directly with them

  3. We will, as per your request, delete all the data related to you that has been stored on our platform.

My questions

  • Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"?

  • Is it GDPR compliant that their answer to my deletion request is "We will delete the data..."

  • Do you see any other issue with how this went?

  • And how should I handle the situation now?

Thanks in advance for any help on that!

Note:

The company seems to be legally based in Norway and I am in Switzerland.

  • Is it a large organisation? Do they have a data protection officer? – Relaxed May 6 '20 at 12:48
  • I don't think it is a large organization, it seems they are new and their platform is still in "beta". They do have a Privacy Policy page which mentions a GDPR Data Controller as being themselves (For the purpose of the General Data Protection Regulation (“GDPR”) the Data Controller is [company name].). – MrUpsidown May 6 '20 at 12:52
  • Depending on the type of processing they do, it's possible they ought to name a DPO (data protection officer) and if they had one, contacting that person/office might move things along and ensure you get a more professional response. But it sounds like they might not have one. – Relaxed May 6 '20 at 12:57
  • Yeah... their DPO is mentioned as their company name, not a physical person, and they don't provide any particular way of getting in touch with them for GDPR questions. – MrUpsidown May 6 '20 at 12:59
  • Wait... reading it again, the last sentence on that page actually mentions a person's name and a dedicated email address. – MrUpsidown May 6 '20 at 13:01
5

Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"?

Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea.

If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution?

Is it GDPR compliant that their answer to my deletion request is "We will delete the data..."

The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”.

You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.

  • Thanks. My original request was: I am therefore asking you to immediately delete any stored data related to me, from both your platform, [named partner website], and any other third-party entity with which you may have shared it. And to confirm to me when this is done. - I know what data I provided them with. All I want is that they delete everything. I am not particularly in need to have a data dump. – MrUpsidown May 6 '20 at 12:56
  • Common sense suggests this would be a very bad idea. - I am not sure I got this right. What would be a very bad idea? – MrUpsidown May 6 '20 at 13:03
  • @MrUpsidown That the GDPR right to access and information would supersede any company policy on granting access to accounts on a given system or create an obligation to set up a dedicated web front end to access the data. It's just a right to access the information in some form, nothing more. – Relaxed May 6 '20 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.