In its decision dated July 23, 2019, GZ DSBD123.822/0005-DSB/2019, the Austrian data protection authority had to deal with the question of whether there is a right to have certain data deleted as part of a customer bonus program. The respondent is a retail company that operates a customer rewards program. The complainant participated in this customer bonus program and subsequently requested the deletion of certain personal data (including with regard to the place and time of purchase), while other personal data (including master data) were to continue to be processed in the respondent’s system. The respondent argued – in summary – that it was not possible to partially delete personal data due to the structure of the database.
The DPA first held that a partial request for erasure with respect to certain data is possible in principle and that a controller cannot evade its obligations postulated in the GDPR by not taking appropriate technical and organizational measures to comply with the requests pursuant to Art. 12 par. 3 GDPR
to be able to correspond.
At the same time, it was stated that the consequence of a complete cancellation, which was offered by the respondent, does not, however, constitute an impediment or hindrance to economic progress. In other words: The only consequence of a complete deletion is that participation in the customer bonus program is no longer possible, but according to current general life experience, such non-participation is not associated with any significant economic disadvantages.