dpc:8A67654EE8C0D7D9C2258588002BC3A2

Our Ref.: 11.17.001.006.048 13 June 2019 Final Decision Complaint against IQ OPTION EUROPE LTD - Deletion Request The Office of the Commissioner for Personal Data Protection (hereafter “CY SA”) refers to the complaint of Mr. XXXXX (hereafter “the complainant”) lodged with the Data Protection Commissioner of Hessen, Germany. Case description The complainant was denied erasure of his data due to his earlier consent to the general terms and conditions. The general terms and conditions, however, do not elaborate on the data subjects' rights but only refer in a general manner to the GDPR. The CY SA requested from IQ OPTION EUROPE LTD, to provide information on:

1. a)The purpose of keeping the data of the complainant,
2. b)The specific legal grounds of non-compliance with the erasure request of the data subject,
3. c)The categories of all the data of the complainant which were not deleted. CY SA received from IQ OPTION the requested information within the set timeframe. IQ OPTION response In its response, IQ OPTION explained that, as a regulated entity they are obliged by the AML national legislation (The Prevention and Suppression of Money Laundering Activities Law of 2007 (Law 188(I)/2007)), specifically provided under section 68 of this law as well as the MiFiD and MiFiR EU regulations, to preserve the data records for a specified retention period (at least 5 years) to ensure that regulators (mainly the Cyprus Securities and Exchange Commission), companies and customers have access to key business records surrounding financial transactions. They provided a list of all the personal data of the complainant, which were not deleted and for each one of them they indicated the legal basis for keeping those data. The legal basis is either national law 188(I)/2007 indicated above or/ and MiFiD and MiFiR regulations. With regards to the subject matter of the complaint, IQ OPTION confirmed that, despite the company guidelines, the reply initially provided to the complainant by their support services was indeed incomplete and did not inform the client of the legal grounds obliging IQ OPTION to maintain his data. As a corrective measure, they confirmed that a formal and complete reply was prepared to be send to the complainant explaining why his personal data cannot be erased due to the legal restraints imposed by the regulator (Cyprus Securities and Exchange Commission) pursuant to Cyprus legislation and confirming that as soon as the date upon which their obligation to maintain the data expires, they will proceed to the removal/erasure of all personal data. IQ option further emphasised in its letter that it is their priority to effectively deal with all requests received, that they adopted all necessary internal technical and organisational measures imposed by the GDPR and the national laws to be in a position to reply to all demands in a timely manner and will do their very best to avoid having any such issues arise in the future. Moreover, IQ OPTION affirmed that it has taken additional measures concerning data subject rights/ privacy policy following the complaint:  All the procedures were reviewed to ensure that data minimisation principle is adequately applied and in particular to ensure that only the absolutely necessary data for the performance of their services are processed and in compliance with the laws and regulations relevant to their activities.  The DPO planned additional training sessions to the staff interacting with the client, to remind them of the procedures. The DPO further circulated detailed instructions as to how the staff should reply to each type of request, in order to avoid having a similar miscommunication with clients in the future. Our view CY SA considers that IQ OPTION provided all the necessary elements related to the complaint. We verified the list of all the personal data of the complainant, which were not deleted and it appears that for each one of them the legal basis for keeping the data is relevant - either national law 188(I)/2007 or/ and MiFiD and MiFiR regulations – and in compliance with the minimisation principle. We further checked with the Cyprus Securities and Exchange Commission that the categories of data maintained are indeed relevant. In light of the above, we conclude that the data of the complainant cannot be erased before the expiration of the timeframe provided in the relevant laws due to lex specialis principle. We consider that, in this case, the right to erasure does not apply because “the processing is necessary for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Article 17