¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
id�c. IHFDw'MAnDfl AlfD CIA1A
PW01EcnaH CGWAISSKHrni
Vs
COMPLAINT
Reference is made to the complaint (registered internally with file number CDP/IMI/LSA/6/2019)
received from the Spanish Data Protection Agency (Agencia Espanola de Proteccion de Datos or
AEPD) concerning ("the complainant") who is alleging that
("the controller" or breached her data protection rights, as enshrined under the General
Data Protection Regulation - Regulation (EU) 2016 /679 ("GDPR" or the "Regulation"). The
complainant contended that her personal data were inserted in without
providing her, at the time the data were obtained, the required information in terms of Article 1 3 of the
GDPR.
INVESTIGATION
From the investigation carried out by this Office and from the controller's submissions, it transpires
that the controller took all the reasonable steps to provide the complainant with the required information
in terms of Article 1 3 of the GDPR.
In the general Terms and Conditions of the contract between the and the complainant, which were
accepted by the complainant , clause 1 1 (ii) states (the translation from
Spanish to English has been provided by the data controller, and is being reproduced verbatim): "The
client is informed and agrees to be required to pay in writing through SMS, email and I or postal mail
to the address and phone number provided by him to or, if he has changed them, to
the new address and I or telephone number communicated to Said requirement shall be prior
to the inclusion in the files in accordance with RD 1720/2007, o
f December 21
Airways House, Second Floor \.. 1+3561 2 3 2 8 7 1 0 0
High Street, Sliema SLM I 549 B [email protected]
MALTA G www.idpc.org.mt
by which the Regulation of development of the Organic Law 15/1999 of December 13 on protection of
personal data is approved, the Maltese Law on data protection and the European Directive 95/46/EC,
of the Parliament and the Council of Europe, of 24 October and other applicable regulations.
To this end, taking into account the nature of distance contracting to which the parties agree and to the
uses of this type of contract, the client acknowledges that by using distance
techniques means that can get in touch with him for any matter (including
), arising from the contractual relationship that binds them through any of these channels,
especially SMS and electronic mail, expressly stating that the data that client enters in the
application are valid and are operational, especially email.
Once the period established in the previous made has expired, the client is
informed and agrees that, in case of continuing with the
client's data may be included in the
In addition:
was sent by post to the complainant's address by the controller.
In the letter the complainant was given ten ( I 0) more days to proceed with the failing
which, she was also informed that her personal data would be included in
;
warning emails and SMSs informing the complainant that would lead to the
inclusion of her personal details were sent respectively on
1 1 . 0 1 . 2 0 1 8 and 1 0 . 0 2 . 2 0 1 8 (for emails), and on 1 7 . 1 2 . 2 0 1 7 and 2 9 . 1 2 . 2 0 1 7 (in case of SMSs).
Moreover in the "Terms and Conditions" available on the data controller's website, at paragraph
2 6 . 1 1 . 4 , the following information can be found: "Without prejudice to the generality of the above
clauses, you acknowledge that the shall transfer information regarding your
(including your Personal Data) to third-entities which process information on ofpersons,
and also that the shall place information regarding your (including your
Personal Data) on the
You also acknowledge that the shall transfer information
idgc.
l!iFCJRMArKW .iUlD [)AJA
P�CTILIH CO.MM\!iSICfll;JiE
regarding your (including your Personal Data) to third entities for the purpose of
".
DECISION
On the basis of the foregoing the Commissioner considers that the complainant was adequately
informed pursuant to Article 1 3 of the GDPR and thus considers the case as closed.
Saviour Cachia
Information and Data Protection Commissioner
Today, the day of August 2 0 1 9