A controller rejected a request to deletion of a blocked account

The DPA found a violation of the principle of transparency.

StatusNot cited by any decision here yet

Lithuania

Personal Data Right to be Forgotten Supervisory Authorities Right to Erasure Legitimate Interest

GDPRhub pageNov 12, 2026Sourcegdprhub.eu

Full text

Machine translation of the decision, via GDPRhub — not the official text.

A controller rejected a request to deletion of a blocked account. The DPA found a violation of the principle of transparency. English Summary. Facts. In 2024, a data subject requested the deletion of his account on Vinted (controller), after it was blocked due to violations of the platform’s rules. The controller rejected this request, stating that the request lacks the grounds necessary to exercise the right to erasure under Article 17 GDPR. According to prior statements to the DPA, after blocking an account, all available data of the data subject is being processed and retained for 3 months. The controller claims it has a legitimate interest under Article 6(1)(f) GDPR in order to ensure a blocked user does not take advantage of being able to re-register on the platform. The data subject lodged a complaint in front of the Polish DPA, claiming the controller refused to act upon his request. The Lithuanian DPA, as the lead supervisory authority, took over this complaint. Holding. The DP

How it connects

Related across sources

C-131/12 Google Spain SL and Google Inc. v AEPD and Mario Costeja González C-131/12 (Google Spain) May 13, 2014 Right to be Forgotten Controllers IP Address

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… Fifth Chamber May 4, 2023 Right to Restriction Controllers Records of processing activities

C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" Jan 7, 2026 Personal Data Fairness & Transparency Controllers

C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… First Chamber Feb 27, 2025 Profiling Personal Data Automated Decision-Making

C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) Oct 6, 2015 Privacy Shield International Transfer Supervision

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) Sep 24, 2019 Right to be Forgotten Accuracy Child Consent