DBA: Right to refuse a request for erasure Summary Our remarks A complainant had asked DBA (a secondhand • The correct legal basis for processing such as selling website) to delete his profile and associated that at issue in the case is GDPR, Article 6(1)(f) personal data. DBA refused the request because three (legitimate interest), and not Article 6(1)(d) (vital independent buyers on DBA had complained about interests), which DBA would otherwise have applied. the user and that DBA needed to keep his data to block future access to the platform. DBA stated that the • DBA’s legitimate interest in storing data relating to complainant had previously tried to circumvent the the data subject meant that neither the conditions blocking by creating new profiles with different email of GDPR regarding the right to erasure were met. addresses. • This case is an example of when other interests DBA emphasized that the storage and processing of overrule the data subject’s right to erasure. the data were necessary to protect the vital interests of buyers, and to assist the police with any investigations in the event of identification. The Danish Data Protection Agency’s decision The Danish DPA concluded that DBA was not under an obligation to erase the data in question pursuant to GDPR, Article 17(1) (the right to erasure). Published: 31-01-2022, Journal number: 2021-31-5439 Tags: Erasure and rectification 129