Audigent, Inc.
- Complaint filed
- 07.05.2026
- Decision
- 08.06.2026
- Time to decision
- 32 days
- Decision number
2.1-1/26/976-1938-2- GDPR articles
- 12, 15, 57
a1faa86b0c840326f3d3d065046180a5951471851cde5010fb1839c853dd3ddbThe document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- Art. 57(1)(f) — handled "to the appropriate extent"
- the GDPR does not oblige issuing an order
- no public interest / an individual request
What was in the complaint
An Art. 15 request was sent on 6 April 2026 with two identifiers found in the HAR of the site soov.ee.
7 April — identity verification via the SixFifty platform was passed, the identifiers were entered, confirmation was received.
10 April — Audigent created a new ticket and demanded identity verification again. Passed the same day.
16 April — verification was demanded a third time. The complainant refused in writing, citing Recital 57 and 64: two completed verifications are enough.
7 May — Audigent closed the ticket with the wording “did not receive the identifier”. No substantive reply was given.
Breaches
Art. 12(1) — systematic obstruction. Identity verification was demanded three times with the identifiers already confirmed. In addition, the SixFifty platform requires JavaScript and does not work in private browser modes.
Art. 12(3) — the 30-day deadline expired without a substantive reply.
Art. 27 — no representative in the EU appointed.
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); the controller is in the USA.
Analysis
Demanding identity verification three times with the identifiers already confirmed is not caution but a barrier. Recital 64 states directly: a controller should not retain additional information solely for the sake of possible requests. A completed verification is enough; demanding it again and again is a way to wear the complainant down, not to protect the data.