REPUBLIC OF CYPRUS OFFICE OF THE COMMISSIONER FOR PERSONAL DATA PROTECTION Our ref. 11.17.001.007.133 23 January 2020 Data Protection Officer Royal Forex Limited Prodromou & Demetracopoulou 2 1090 Nicosia, Cyprus Dear Sir, Further to the exchange of communications between Cyprus SA (the Commissioner for Personal Data Protection) and Royal Forex Limited concerning a complaint involving GMO Trading, we would like to bring to your attention the following assessment of the Commissioner. Summary of the Case The data subject had an account with your company and during the period 16/6/18 - 20/6/18 a financial loss incurred. The DS made a complaint to the complaints department of GMO Trading and on 10 July 2018 she was offered a refund of the sum of GBP 3,500 under a settlement agreement and as a gesture of good will. On 17 October 2018 the data subject exercised the right of access under the GDPR requesting “any copy of letters, emails, telephone or text messages you have” in her name. She sent a reminder to complaintsdepartment@gmotrading.com on 16 November 2018 with no result. Finally, she lodged a complaint to the UK Supervisory Authority. Investigation by CY SA Cyprus SA contacted Royal Forex Ltd in July 2019. The company explained that the failure to respond to the data subject’s request was due to the facts that (
- a)there has been a change of Directors and Data Protection Officer and therefore the relevant request was misplaced during the handover of open GDPR related enquiries, and (
- b)once the company received the request it was examining the possibility of interfering into third party data protection rights, while liaising with the clients. Therefore, the company was in communication with external advisors on the matter. The company affirmed that it eventually complied with the data subject request by email sent to her on the 23 of August, 2019 providing a link to all call recordings between the client and GMO Trading, and a second email on the 17 th of September, 2019 providing a link to all communication exchanged between the client and GMO Trading. The second email was sent again since there was a limitation on the link provided of two weeks (14 days) to be active, and the data subject did not use it during this period. 1 Iasonos str., P.O. Box 23378, 1682 NICOSIA, CYPRUS Tel.: +357 22818456, Fax:+357 22304565 E-mail: commissioner@dataprotection.gov.cy ,Website: http://www.dataprotection.gov.cy Commissioner’s view and corrective actions The Commissioner considers that Royal Forex Ltd (GMO Trading) did not comply with data subject’s request within the timeframe provided for in the GDPR. The initial data subject’s request was sent on the 17 October 2018. A reminder was sent on 16 November 2018. The data subject’s request was complied with a year later and after the data subject has filed an official complaint. Article 12.3 of the GDPR stipulates that “The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.” In this case, the controller did not provide any information on actions taken within one month, nor informed the data subject on the event of complexity, asking an extension of two additional months. In light of the above, the Commissioner instructs the controller to take all appropriate technical and organisational measures to henceforth comply with the provisions of with in article 12 of the GDPR and respond to all data subject requests within the timeframes provided for in this article. The Commissioner reserves the right, in the event of any future complaints lodged by data subjects, to use all powers afforded to her by the GDPR and by national Law 125(I)/2018. Commissioner for Personal Data Protection