This complaint concerned an initial refusal by the data controller to comply with an erasure request made by the complainant, pursuant to Article 17 GDPR. The complainant first lodged their complaint via the Spanish Data Protection Authority, the AEPD, who then transferred the complaint to the DPC as the Lead Supervisory Authority.

The complainant stated that they were named, and therefore identified, in a negative review relating to their place of employment . The review, accompanied by a partial image of the complainant, had been posted online . The complainant had sought the removal of their name and any associated images from the review. During its engagement with the DPC on the matter, the data controller advised that they had reviewed the content in question in the context of their own privacy guidelines for the removal of content from the website and that they considered the content did not infringe upon same .

The DPC requested that the data controller review the matter again, in the spirit of amicably resolving the complaint . The data controller subsequently reverted to advise that after a further assessment of the content in question they had made the decision to remove the review posting in its entirety .

This case study demonstrates the benefits, to individual complainants, of the DPC’s intervention by way of the amicable resolution process . In this case, this led to the complainant being able to affect their right of erasure over their personal data, as afforded to individuals under Article 17 of the GDPR .