Final decision
The Luxembourg supervisory authority (“CNPD”) refers to the complaint of
lodged with the supervisory authority of Spain.
The initial wording of the complaint on IMI stated that:
“The complainant states that he has received a parcel from someone unknown to him, and
according to a receipt found with a watch inside the parcel, the sender is an client that
wanted to return the product had just purchased. Apparently, has given the
complainant's name and address to a client, as a person who can receive and manage the
devolution. He has contacted by phone and by mail, but has got no answer to his request
.”
Based on said complaint, the CNPD requested the controller (hereinafter ) to provide a
detailed description of the issue relating to the processing of the complainant’s data as per Article
58.1(a) GDPR, in particular as regards the lack of reaction by the controller to the complainant’s
request, as well as regards the complainant’s personal data having allegedly been transmitted to a
third party.
The CNPD received the requested information within the set timeframe.
Following an enquiry by the CNPD, has demonstrated that:
- A third party purchased an item on from XXX,
who delivers the products directly to its customers in Spain.
- had also purchased a similar item from XXX, which had delivered to him
and therefore had shipping address. When the first customer sought to
return the item to , the return label contained the address details of the complainant
because had included the complainant’s address on the label for returns.
- According to , (XXX) behavior was a clear breach of
policies and after their own internal inquiry, took corrective measures with this
- provided to the CNPD the answer given to , as well as the previous
correspondence exchanged with
Thus, based on the above-mentioned explanations, the CNPD did not identify any infringement of
the obligations set out in Regulation (EU) 2016/679 (GDPR) by .
As the complaint has only a limited personal impact, the CNPD has consulted the Spanish SA to
determine whether the case could be dismissed. The CNPD and the Spanish SA agreed that, in
view of the above, no further action is required and that the cross-border complaint (national
reference ) should be closed.
A draft decision has been submitted by the CNPD on 3 April 2019 to the other supervisory
authorities concerned as per Article 60.3 GDPR (IMI entry number ).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities shall be
deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission