Groupon International Limited

introduction of the GDPR on 25 May 2018, until 8 October 2018. 6.2. The complainant argued that this requirement constitutes an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR. For instance, the complainant stated: “In this application, I again pointed out that the transfer of the ID card is too far-reaching and dangerous and is not based on the GDPR…Deleting an account should be as easy as registering it. At registration, no ID is scanned, which would be excessive in my opinion in relation to the principle of minimization” (initial complaint by A.B. to the Office for the Protection of Personal Data, 4 June 2018). 6.3. Groupon, for its part, asserted that it complied with the principle of data minimisation in the context of its initial processing of the complainant’s personal data, stating that “…the Complainant's personal data was adequate, relevant and limited to the purposes for which it was processed, i.e. opening and operating his account. The data consisted of his first name, last name, home address and email address” (correspondence from Groupon to the DPC, 11 April 2019). Groupon did not specifically comment on how its requirement for a copy of a national ID card in the context of a data subject erasure request complied with the principle of data minimisation1. It is, of course, this data processing that is at the heart of this complaint.