Summary Final Decision Art 60
Date of final decision: 11 September 2019
Legal Reference: Lawfulness of the processing (Article 6), Right to erasure (Article 17)
Decision: No infringement of the GDPR
Key words: Lawfulness of the processing, Right to erasure, Consumer protection, Anti-Money Laundering, Legal obligation
Summary of the Decision
Origin of the case
The complainant requested the deletion of her account on the controller’s website. Her request was not granted by the controller. The complainant filed a complaint with the CSA.
According to UK anti-money laundering legislation, the controller was required to retain customer information for a period of five years after the end of the business relationship. The LSA found that the complainant’s information had been retained in line with the controller’s legal obligations.
As the controller complied with his data protection obligations, no further action towards it was taken by the LSA.
This text has been converted automatically from the PDF available via
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
Please see also EDPB Copyright page