In its decision dated July 23, 2019, GZ DSBD123.822/0005-DSB/2019, the data protection authority had to deal with the question of whether there is a right to
exists that certain data is deleted within the framework of a customer bonus program.
The respondent is a retail company that operates a customer rewards program. The complainant participated in this customer bonus program and subsequently requested the deletion of certain personal data (including with regard to the place and time of purchase), while other personal data (including master data) were to continue to be processed in the respondent’s system. The respondent argued – in summary – that it was not possible to partially delete personal data due to the structure of the database.
The DPA first held that a partial request for erasure with respect to certain data is possible in principle and that a controller cannot evade its obligations postulated in the GDPR by not taking appropriate technical and organizational measures to comply with the requests under Art. 12 para. 3 GDPR to be able to comply.
At the same time, it was stated that the consequence of a complete cancellation, which was offered by the respondent, does not, however, constitute an impediment or hindrance to economic progress. In other words: The only consequence of a complete deletion is that participation in the customer bonus program is no longer possible, but according to current general life experience, such non-participation is not associated with any significant economic disadvantages.
The complete deletion from a creditworthiness database, for example, is to be assessed differently, as the lack of a hit for a query means that a contract is not concluded.
contract (see the decision of December 5, 2018 on GZ DSB-D123.211/0004-DSB/2018, not legally binding).
As a result, the data protection authority granted the respondent leeway for the design of its customer bonus program within the framework of private autonomy and within the scope of its freedom of acquisition and did not require the respondent to take appropriate technical and organizational measures, i.e., to redesign its system to enable partial deletion.
The appeal was therefore dismissed and the decision is final.