Final decision
The Luxembourg supervisory authority (“CNPD”) refers to the complaint of (hereinafter
“ ”) lodged with the supervisory authority of Spain.
The initial wording of the complaint on IMI stated that:
“The complaint is about a telegram sent by a third party to the complainant in which his full name
and address are included, as well as an order number. In this telegram the third party
claims that he knows that a parcel purchased from by him has been wrongly received by
the complainant, and wants to get it back, threatening the claimant to go to the police. The third
party access to the complainant personal data seems to indicate that his personal data have not
been properly protected, thus the complaint.
The complainant actually denies that the third party parcel was delivered to him, but after a first
interaction with , confirmed to him that according to his records, it was indeed
delivered to his address. Further analysis made by the complainant with the courier seems to
indicate that the courier messed up delivery references, as he received another parcel on that date,
and they provided to wrong delivery information which linked to the order
number of the third party.
may have provided the personal data of the claimant to the user who requested the order,
producing a violation of his privacy.”
Based on said complaint, the CNPD requested the controller (hereinafter ) to provide a
detailed description of the issue relating to the processing of the complainant’s data as per Article
58.1(a) GDPR, in particular as regards the complainant’s personal data having allegedly been
transmitted to a third party.
The CNPD received the requested information within the set timeframe.
Following an enquiry by the CNPD, has demonstrated that:
1. On 21 May 2018, (a third party customer) purchased an item on
from ,a who delivers the products directly to
its customers in Spain.
2. On 28 May 2018, contacted customer service indicating that he had
previously contacted – carrier in charge of delivery – to confirm the status of
his order. In accordance with the facts reported by , when he provided the
tracking number to , a employee confirmed that this reference
corresponded to a package that was going to be delivered to the complainant, and
provided with the full name and address of the complainant.
3. Given that did not receive the package, he filed an ” claim
on 29 May 2018 and after investigated the case, it refunded the customer in
full and suspended the selling privileges of the seller as a result of being in breach of
policies. informed the CNPD that customers can request a refund
via the if they encounter a problem with items sold and fulfilled
by a third party seller on
4. As part of the internal investigation of , contacted on 17
October 2018 to check what delivery information they provide when someone calls and
asks for delivery details via reference number. A employee confirmed that the
package in question had been delivered to the complainant on 28 May 2018, in line
with the information had previously provided to .
5. With respect to the correspondence between the complainant and ,
has not found any account on under the exact name or alleged address of
the complainant, but only one under the name of XXX. Also, stated that the
account details do not show any communications linked to this account, nor a shipping
address, payment information or any connection whatsoever with order.
6. Therefore, it seems that in this instance, the company provided the
complainant's details to . There is no further evidence that this information was
provided by to either or and it therefore seems that the data
relating to the complainant must have already been stored by in their systems
and somehow connected by them to the order made by the customer .
The CNPD wants to point out that provided all the necessary elements related to the
complaint.
Thus, based on the above-mentioned explanations, the CNPD did not identify any infringement of
the obligations set out in Regulation (EU) 2016/679 (GDPR) by .
As the complaint has only a limited personal impact, the CNPD has consulted the Spanish SA to
determine whether the case could be dismissed. The CNPD and the Spanish SA agreed that, in
view of the above, the data controller did not provide the seller with the complainant’s address,
that no further action is required and that the cross-border complaint (national reference
) should be closed.
A draft decision has been submitted by the CNPD on 3 April 2019 to the other supervisory
authorities concerned as per Article 60.3 GDPR (IMI entry number ).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities shall be
deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission