Deletion of personal data

Question

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background.

During their "pre-qualification process", I had to register a separate account with one of their partners to take a test. During that phase, I decided this wasn't for me.

This is when I realized that I couldn't access the account I created with them (sign in didn't work), nor could I access my account on their partner's website (same issue).

So I wrote them an email, politely asking them to delete my account and all my personal data from their website and partner's website and to confirm to me when this would be done.

They answered that:

1. The reason why you were not able to log into your profile is that you haven't completed the pre-qualification process yet

2. In regards to our partner, they are a separate company from us, so I am afraid that you will have to discuss this issue directly with them

3. We will, as per your request, delete all the data related to you that has been stored on our platform.

My questions

• Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"?

• Is it GDPR compliant that their answer to my deletion request is "We will delete the data..."

• Do you see any other issue with how this went?

• And how should I handle the situation now?

Thanks in advance for any help on that!

Note:

The company seems to be legally based in Norway and I am in Switzerland.

Answer 1

Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"?

Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea.

If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution?

Is it GDPR compliant that their answer to my deletion request is "We will delete the data..."

The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”.

You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.