IQzone, Inc.
- Complaint filed
- 13.05.2026
- Decision
- 08.06.2026
- Time to decision
- 26 days
- Decision number
2.1-1/26/1020-2020-2- GDPR articles
- 12, 15, 57
eae4186559075563409916dab42640fc6a02aa54b88a5bf824590366e34e4feaThe document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- Art. 57(1)(f) — handled "to the appropriate extent"
- the GDPR does not oblige issuing an order
What was in the complaint
An Art. 15 request was sent on 6 April 2026. The 30-day deadline expired on 6 May without a reply.
8 May — IQzone’s CTO Matthew A. Feadler replied in a single sentence: “IQzone does not store any personal data about you”.
8 May — the complainant challenged this technically: the HAR of the site soov.ee recorded identifiers (a UUID and a hash identifier) transmitted to cs.iqzone.com. These are personal data under Art. 4(1) — the Breyer case (C-582/14).
12 May — the CTO replied: “the platform associated with cs.iqzone.com no longer exists — it has been decommissioned, and all associated data has been destroyed”.
Breaches
Art. 12(3) — there was no reply within the deadline.
Art. 15 — “the data has been destroyed” does not meet the requirements: Art. 15 obliges disclosure of all data processed, including historical data, purposes, basis, recipients, periods.
Art. 27 — no representative in the EU appointed.
Destruction of evidence — the company confirmed the destruction of data after the subject’s request.
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); the controller is in the USA.
Analysis
The complainant presented specific identifiers from the network log. The reply “we decommissioned the platform and destroyed everything” was made after the Art. 15 request. If the data existed at the moment of the request (and the HAR records this), its destruction does not release the company from the obligation to disclose what exactly was being processed.