¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Summary Final Decision Art 60
Complaint
No violation
Background information
Date of final decision: 21 December 2018
LSA: DE - North Rhine-Westphalia
CSAs: DE - Rhineland-Palatinate, DE - Mecklenburg-Western Pomerania, DE -
Bavaria (priv), DE - Lower Saxony, DE - Saarland, ES
Legal Reference: Lawfulness of the processing (Article 6)
Decision: No violation
Key words: Direct Marketing, Legitimate interest, publicly available data
Summary of the Decision
Origin of the case
Complainant states they received postal advertisement and tried to exercise their right of access and
right to erasure. The contacted branch stated that the letter was not sent to the correct recipient, as
they do not manage personal data. The correct establishment is in Germany. The complainant
contacted their local SA as they deem that the controller is wrongfully processing their personal data,
which is stored in a publicly accessible register.
Findings
According to recital 47 and Art 6.1.f GDPR legitimate interest of the controller or of a third party may
be used as legal basis, also when the processing is carried out for marketing purposes. LSA argues the
data subject did not present any prevailing fundamental rights and freedoms and neither are
prevailing rights and freedoms apparent, as the data is already publicly accessible. As such, the
aforementioned legal basis “can be considered as an allowing legal basis.”
The original request of access and to erasure were filed before the 25 May 2018. Articles 13 and 14
GDPR were thus not yet applicable. However, under the GDPR the data subjects are to be informed
from which source the personal data originate. The enterprise should be informed about this for
future advertising mails”.
1
Decision
The LSA deems this not be an infringement. The processing of publically available personal data for
direct marketing purposes may constitute lawful processing according to Art 6.1.f GDPR.
2