idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONER
Information and Data Protection Commissioner
vs
# COMPLAINT
Reference is made to the complaint (registered internally with file number CDP/IMI/LSA/2/2019) received from the Spanish Data Protection Agency (Agencia Española de Protección de Datos or AEPD) concerning the “complainant”), who is alleging that (“the bank” or “the controller”) breached her data protection rights, as enshrined under the General Data Protection Regulation – Regulation (EU) 2016/679 (“GDPR” or the “Regulation”). The complainant contended that she has been receiving several unsolicited calls to the fixed line number corresponding to her place of residence even after having submitted a right of erasure request and such erasure confirmation was made by the controller. It has to be noted that the owner of the concerned phone number is either of the complainant and that the erasure request was therefore submitted by
# INVESTIGATION
As part of the investigation process, through emails dated 17th January 2019 and 17 May 2019 respectively, the Commissioner requested the controller to put forward its submissions on the allegation raised by the complainant. Submissions were received on the 25th January 2019 and on the 24th of May 2019, and included the following principal arguments:
a. on \(7^{\text{th}}\) August 2018 the bank approved a 30 days loan to a client, namely the "client" or "the borrower");
b. when submitting the online loan application, the client provided the bank with two phone numbers one of which being
Airways House, Second Floor
High Street, Sliema SLM 1549
MALTA.
(+356) 2328 7100
www.idpc.org.mt
idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONER
c. on 6th September 2018, the day the loan was due for payment, the bank was informed by the client that she would have been able to pay the loan only on the 1st of October 2018;
d. starting from the 13th of September the bank tried to contact the client on the number mentioned above without knowing that the number corresponds to the complainant's residence and not to its client. During these calls the complainant explained to the data controller that she was not the person they were looking for and that she didn't know the bank's client [REDACTED] was invited to submit, by using a form available on the controller's website, a right of erasure request. It has to be noted that while the complainant is the user of the phone number concerned, the phone number owner is [REDACTED] On the 23rd of October 2018 the bank received the erasure request from [REDACTED] and on the 2nd of November an email confirming the phone number erasure from the data controller's database was received by [REDACTED]
e. the controller has only one database where phone numbers, belonging to bank's clients, are recorded in the corresponding client's records. Once [REDACTED] residence phone number was erased from the bank's records, the phone number would no longer appear in the bank's database. It resulted that the controller erased the phone number from its database immediately after the data subject's erasure request on 23rd October 2018, and it follows that the bank's personnel was not in any way able to make use of the phone number after this date;
f. from the controller's call logs it transpires that the last call to the complainant's residence phone number was made on 25th October 2018 at 15.22 while from the complaint's report it appears that further unsolicited phone calls were still received between the 2nd of November and the 9th November 2018 (date when the complaint was filed with the AEPD);
g. from the complainant's report it also transpires that, during one of these phone calls, the complainant was erroneously informed that she was still receiving unsolicited calls as the concerned phone number, while it was erased from one database on the 23rd of October 2018, was still recorded in another data controller's database. The complainant was thus invited to submit a second erasure request to delete the number also from this database;
h. the complainant sent a second erasure request on the 5th November 2018. The answer to this request, that was sent by email on the 6th of November, was meant just to reconfirm the erasure made on the 23rd of October. However, the content was written in such a way that led the
idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONER
complainant to assume that this was a new erasure confirmation relating to the data recorded in the other data controller's database. This assumption was not correct as the bank has only one database (please refer to paragraph "e");
i. this Office eventually instructed the data controller to send a further erasure confirmation to the complainant. This third erasure confirmation was sent to [REDACTED] on the \(11^{\text{th}}\) of February 2019 and a copy was also received by this Office on the same day;
j. taking into consideration that the complainant's residence phone number was fraudulently provided to the bank by its client, the bank cannot exclude the possibility that the complainant's residence's phone number was provided by the same client, also to other entities/lenders and that these entities/lenders may make use of it after the \(25^{\text{th}}\) October 2018.
# DECISION
On the basis of the foregoing the Commissioner is hereby instructing the data controller to implement the appropriate technical and organizational measures to make sure that personal data are accurate and, where necessary, kept up to date and that every reasonable step is taken to ensure that personal data that are inaccurate, having regards to the purposes for which they are processed, are erased or rectified without delay.
Information and Data Protection Commissioner
Today, the
17th
day of June, 2019