Full text
A controller rejected a request to deletion of a blocked account. The DPA found a violation of the principle of transparency. English Summary. Facts. In 2024, a data subject requested the deletion of his account on Vinted (controller), after it was blocked due to violations of the platform’s rules. The controller rejected this request, stating that the request lacks the grounds necessary to exercise the right to erasure under Article 17 GDPR. According to prior statements to the DPA, after blocking an account, all available data of the data subject is being processed and retained for 3 months. The controller claims it has a legitimate interest under Article 6(1)(f) GDPR in order to ensure a blocked user does not take advantage of being able to re-register on the platform. The data subject lodged a complaint in front of the Polish DPA, claiming the controller refused to act upon his request. The Lithuanian DPA, as the lead supervisory authority, took over this complaint. Holding. The DP