FOR THE PROTECTION OF PRIVACY AND TRANSPARENCY OF THE STATE
FOR INTERNAL USE
Holder of Information: Estonian Data Protection
Inspectorate
Notation made: 29 July 2019
Access restriction is valid until: 29 July 2094
Basis: clause 35 (1) 12) of the Public Information Act
Dear Ref.: 13 March 2019
Ref.: 29 July 2019 No. 2.1.-1/19/483
Notice of termination of the proceeding in regard to the protection of personal data
Proceedings are closed at the E rotection Inspectorate concerning the complaint you
submitted on the activities of (hereinafter . In your complaint, you
pointed out that your personal n transferre d party on
(hereinafter ) without a legal basis to do so.
The Data Protection Inspectorate initiated a national supervisory review proceeding concerning
the data controller. In their reply, the controller has confirmed that they have forwarded your
personal data lawfully:
The person was a client of who ordered by signing a service
provision contract with the on 27 July 2012. On 13 July 2018, the client
sent an application for the termination of the contract to t At the end of
the contract, the client owed a debt of 14.73 euros to the n 25 August
2018, 8 August 2018 and 22 August 2018, messages were sent to the client as reminders (Annex
1) of the debt, including information on how to pay the debt. On the two following occasions,
on 31 August 2018 and 16 October 2018, we explained that if the debt is not paid, the debt
claim will be forwarded to the claimant
Clause 12.3 of the Contract concluded with the client stipulates that the has the right
to transfer, without consent from the client, its contractual rights an ions to third
parties, if that the transfer does not adversely affect the rights of the client. The client's rights
have not been impaired, as it was agreed upon, during the conclusion of the contract, that the
client will be provided a service and the shall receive a fee for the provision of the
service. If the debt for the service remains he service provider has the right to demand
the payment of debt, with which the client had to take into account when signing the contract.
The client has also agreed to the privacy policy of (clause 12.4 of the contract stipulates
that the will process personal data in nce with the privacy policy), which
clearly states that, in order to perform the contract concluded with the client (Article 6 (1) (b)
of the General Data Protection Regulation), we use the client’s data, inter alia, in the event of
a delay in the fulfilment of a financial obligation arising from the client’s contract to provide
information concerning the client and their debt (given name, surname, personal identification
code, amount of debt, delay time, creditor, etc.) to the processor of the credit database and/or
persons handling debts and, in the case of assignment of the right of claim, to a new creditor.
The data will be forwarded for the purpose of disclosure in the relevant credit register. If the
client has liquidated their debt, they have the right to demand that the respective persons
terminate the processing of the client’s personal data.
In addition to provisions concerning the disclosure of data, the privacy policy also stipulated
that we can use third party enterprises who provide services to us, e.g. who provide
infrastructure and IT services (incl. storing data, forwarding of data, monitoring quality),
process credit card transactions, provide customer service, carry out recovery of debts, collect
data for debt analysis and improvement of data, as well as concerning client inquiries, and
conduct other statistical analyses. These enterprises may have access to client data in order to
provide their services. We do not authorize these companies to use or disclose the client’s
personal data, except in order to provide the services we require.
Tatari 39, Tallinn 10134 / 627 4135 / [email protected] / www.aki.ee / Registry code 70004235
The invoices submitted to the client (attached to the letter of the Lithuanian Data Protection
Inspectorate) also state that if the invoice is not paid, t dure for claiming payment of
the invoice will be forwarded to Therefore, the has repeatedly stressed in the
contract, privacy policy, invoic en reminding bt, that if the debt is not paid,
the claim procedure will be forwarded to The client failed to pay the debt, after which
the transferred the debt to the da sor, in this case to In a letter of debt
rec t by to the person, it has also been explained th will process the
person’s person accordance with the contract concluded wit and based
on legitimate interest for the purpose of recovering the debt.
Concerning the appellant, the following data was provided to client number, plan,
personal identification code, first name, surname, address, e-mai , mobile number, time
of conclusion of the contract, date and manner of sending the reminders of arrears, invoice
details, debt.
The has compiled a privacy policy (data processing principles), which is accessible
on t A sample of the contract can be
Separately, the data controller informed the Inspectorate that the appellant had not approached
them directly. The Inspectorate explains that, in general, with regard to procedural economics,
only those complaints where the parties have not reached an agreement with each other or the
person has not received a reply to their inquiry should be sent to the Inspectorate.
The Inspectorate also explains that with regard to processing of personal data, it only assesses
whether the transfer of personal data has been lawful, not the lawfulness of the debt claim. The
Estonian Data Protection Inspectorate does not have the competence to assess whether the debts
of individuals against the creditor have arisen lawfully, what the claims consist of, whether or
not the debt has actually been liquidated, whether or not the rules for the assignment of the
claim have been complied with, as those are disputes that arise from contractual relations.
Settlement of contractual disputes between private parties is a matter for the civil court. Law
enforcement agencies cannot and are not obligated to be unable to identify the actual legal
relationships between individuals, in each case, which may be very difficult when resolving in
private disputes.1 If the appellant finds that the creditor has violated the law in concluding,
executing or assigning loan agreements, they have the right to bring the action before the court.
A similar conclusion was reached by the Tallinn Administrative Court on 22 March 2011 in its
judgment No 3-10-994. In that judgment, the court held that the Data Protection Inspectorate
had no legal competence to settle disputes arising from contractual relations, including the
assessment thereof. The court noted that the Data Protection Inspectorate is a supervisory
authority of the state that is competent to monitor compliance with the Personal Data Protection
Act and legislation established on the basis thereof, and to conduct proceedings of the violations
arising therefrom.
The Inspectorate has established that the person has been informed in the contract that was
concluded with them that their personal data will be transferred upon the occurrence of a debt.
The contract of personal data proces gt General Data Protection
Regulation has been signed between and . In addition, the privacy
policy also includes information reg issi the name of a particular
legal entity is indicated in the invoices provided to the client. With this, the data controller has
fulfilled every possible obligation to inform the person.
The transmission of data for the recovery of debt claims is a common practice for large
enterprises and had to be acknowledged by the individual at the time of concluding the contract;
same applies to the fact that the parties are able to settle any contractual disputes that they are
not able to resolve among themselves in the court.
Inspection did not identify any violations by the data controller, and the national supervisory
review proceeding is therefore terminated.
1 Page 20 of the explanatory memorandum of the Draft of the Law Enforcement Act.
2 (3)
According to Administrative Procedure Act article 75 a challenge concerning an administrative
act or measure shall be filed within thirty days as of the day when a person becomes or should
become aware of the challenged administrative act or measure.
Kind regards
3 (3)