With the decision DSB-D123.822 / 0005-DSB / 2019, the Austrian data protection authority had to deal with the question: Is there a right to delete certain data from a customer loyalty program? The affected company is a retailer offering a customer loyalty program. The complainant uses this customer loyalty program and subsequently requested the deletion of certain personal data (including, but not limited to, the place and time of purchase), while other personal data (including master data) should continue to be processed in the customer loyality program. The company stated that it was not possible to partially delete personal data due to the structure of the database.
At the beginn, the Data Protection Authority stated that a partial request for cancellation of certain data is admissible and that a responsible person can not get rid of this duties by not taking appropriate technical and organizational measures to comply with GDPR Article 12.
At the same time, the data protection authority in Austria stated that the consequence of a complete cancellation, which the company offered, was not a disproportional economic disadvantage for the customer. In other words, the consequence of a complete deletion is merely that participation in the customer bonus program is no longer possible, but the non-participation is not associated with significant economic disadvantages.