Groupon Ireland Operations Limited – March 2024

• Year: 2024
• Date: 08 March 2024
• Section: Decisions made under data protection act 2018

1

DPC Complaint Ref:

IMI Ref:

Complaint Received From: Baden-Wurttemburg DPA

Date Of Decision: 8 March 2024

Complainant:

Data Controller: Groupon International Limited

Re: v Groupon International Limited

DECISION

This is a Decision of the Data Protection Commission of Ireland (“DPC”) in relation to

DPC complaint reference, (hereinafter referred to as the “Complaint”),

submitted by (“Complainant”) against Groupon International Limited (“Groupon”) to

the Baden-Wurttemburg Data Protection Authority (“BW DPA”). As the subject matter of

the Complaint was determined to be cross-border in nature, the Complaint was

subsequently transferred to the DPC, as the Lead Supervisory Authority (“LSA”) for

Groupon.

This Decision is made pursuant to the powers conferred on the DPC by section 113(2)(a)

of the Data Protection Act 2018 (“Act”) and Article 60 of the General Data Protection

Regulation (“GDPR”).

Communication of Draft Decision to “supervisory authorities concerned”

In accordance with Article 60(3) GDPR, the DPC is obliged to communicate the relevant

information and submit a draft decision, in relation to a complaint regarding cross border

processing, to the supervisory authorities concerned for their opinion and to take due

account of their views.

In accordance with its obligation, the DPC transmitted a Draft Decision in relation to the

matter to the “supervisory authorities concerned”. As Groupon offers services across the

2

EU, and therefore the processing is likely to substantially affect data subjects in every EU

member state, the DPC in its role as lead supervisory authority identified that each

supervisory authority is a supervisory authority concerned as defined in Article 4(22) of

the GDPR. On this basis, the Draft Decision of the DPC in relation to the Complaint was

transmitted to each supervisory authority in the EU and EEA for their opinion.

Background to the Complaint

1. On 11 June 2018, the Complainant contacted Groupon by email requesting access

to their personal data and the subsequent erasure of those personal data. The

Complainant sent this email to a number of different channels within Groupon. The

Complainant also telephoned Groupon on 13 and 14 June 2018 in relation to their

access and erasure requests.

2. In response, the Complainant was directed to submit their requests via Groupon’s

online portal, which required the Complainant to upload a copy of an ID document

in order to verify their identity.

3. The Complainant considered this requirement to be excessive and an obstacle to

the exercise of their rights. The Complainant also noted that no such requirements

were in place in order to register or create an account with Groupon. Accordingly,

on 19 June 2018, the Complainant submitted a Complaint to the BW DPA. The

Complaint at this point was solely in relation to the Complainant’s concerns about

being asked to upload a copy of an ID document. In the circumstances where the

DPC was deemed to be the competent authority for the purpose of Article 56(1)

GDPR, the BW DPA subsequently transferred the Complaint to the DPC.

Complaint Handling and Investigation by the DPC

4. On 1 February 2019, the DPC wrote to Groupon formally commencing its

investigation and requesting that Groupon address the concerns raised.

5. In response, Groupon explained that it had since changed its verification

requirements in October 2018 so that photo ID is no longer required, and that it

now authenticates data subject rights requests on the basis of the associated email

address in order to ensure the request is valid in accordance with GDPR

requirements. Groupon invited the Complainant to submit another request which

Groupon would process in accordance with this new system.