1/4
DATA PROTECTION AUTHORITY
PRINCIPALITY OF LIECHTENSTEIN
Summary of the Final Decision
Vaduz
August 27, 2019
Ref: 103.1.2/2019-283
IMI Case A60FD 75031
Decision of the Data Protection Authority of the Principality of Liechtenstein (DPA)
August 9, 2019
Parties:
Complainant: [may not be disclosed]
Controller:
regarding a complaint lodged with the Data Protection Authority Liechtenstein
This complaint was treated as confidential. The decision has therefore been anonymised.
The masculine form has been used throughout.
DECISION
The Data Protection Authority Liechtenstein finds
1. That has contravened Art. 15 GDPR. Points 2, 4 and 5 of the
information provided do not include all the necessary elements. In addition, the
Data Protection Authority recommends that specifies in Point 7
which supervisory authority is competent.
2. That the requests submitted by the legal representative are to be rejected.
1. Background to the case
On 18 November 2018 the complainant lodged a complaint against the controller for
infringement of Art. 15 GDPR with the Commissioner for Data Protection of Lower Saxony.
In his complaint of 18 November 2018 the complainant alleges that he had requested the
controller to provide full information pursuant to Art. 15 GDPR on 3 November 2018. The
Städtle 38 | Postfach 684 | 9490 Vaduz | Liechtenstein | T +423 236 60 90 | [email protected] | www.datenschutzstelle.li
2/4
complainant stated that the information provided by the controller pursuant to Art. 15
GDPR of November 2018 is deficient in the following points:
1. Point 2 (processing purpose) when compared with point 4 (recipients) of the
controller’s information under Art. 15 GDPR from November 2018 is incomplete resp.
contradictory;
2. Point 5 (storage period) does not specify the specific storage period or the criteria
according to which the storage period can be determined;
3. Point 7 (right of appeal) does not specify which authority shall be competent to handle
complaints of the persons concerned.
As a cross-border case, the complaint was dealt with in accordance with Article 60 GDPR.
The complaint was uploaded to IMI (IMI number 58561) on 24 January 2019. For
having its place of domicile in Liechtenstein the DPA Liechtenstein was the
lead supervisory authority in accordance with Article 56 (1) GDPR.
The legal representative of the controller was requested by letter of 3 April 2019 to reply
to the complaint by 17 April 2019. The legal representative replied to points 2, 5 and 7 of
the controller’s information under Art. 15 GDPR from November 2018 as follows:
1. Concerning point 2 (processing purpose) the legal representative of the controller
stated that the complaint with respect to this point is incorrect since the marketing use of
the personal data by third parties is no processing according to point 2. In the opinion of
the legal representative of the controller only the controller’s own processing shall be
subject to point 2. Point 2 therefore shall not include that third parties store and use the
data for their own purposes.
2. Concerning point 5 (storage period) the legal representative of the controller
acknowledged in his counter-stateme ved. However, since
even well-known companies such as did not have more
specific formulations with respect to the storage period there shall be no absolute
necessity to name a specific storage period or the criteria for the storage period.
3. Concerning point 7 (right of appeal to the supervisory authority) the legal
representative of the controller stated that the legal opinion quoted by the complainant
to substantiate his complaint, namely the legal opinion found in Paal / Pauly / Paal, 2nd
edition 2018, DS-GVO Art. 15 under point 29, is an individual opinion amongst many
others. He stated that as of yet there is no evidence that the opinion quoted will become
predominant. The legal representative of the controller further stated that there is no
explicit obligation under Article 15 of the GDPR or from Recital 63 to designate the
respective competent supervisory authority.
3/4
2. Complaint:
On the basis of the submissions of the complainant, the legal question was whether the
controller gave incorrect and insufficient information to the complainant which the
complainant had a right to receive according to Article 15 GDPR.
3. Legal framework:
a) Competence of the lead supervisory authority
is a company domiciled in Liechtenstein, registered in the Liechtenstein Trade
Register under number . The GDPR has been in force since 20 July 2018
in Liechtenstein for all companies or other data processing authorities based in
Liechtenstein. The complainant requested the controller on 3 November 2018 to provide
full information pursuant to Art. 15 GDPR. The controller complied with this request for
information beginning of November 2018. According to Art. 55 GDPR, the DPA
Liechtenstein is the competent national data protection supervisory authority.
According to Art. 2 para. 1 GDPR, the GDPR applies to the full or partial automated
processing of personal data. According to the definition in Art. 4 point 1 GDPR "Personal
data" are all information relating to an identified or identifiable natural person, such as
names, location data, online identification and other personal data as stated in Art. 4 point
1 GDPR. In accordance with the controller's letter of information from the beginning of
November 2018 the complainant in particular processed the address data, contact details
and date of birth. These data are personal data of natural persons in accordance with the
legal definition of Article 4 (1) GDPR. According to Art. 2 para. 1 GDPR, the present
complaint falls within the material scope of the GDPR.
b) Requests submitted by the processor’s legal representative
As aforementioned, the legal representative of the controller raised several concerns
regarding national administrative law. The DPA Liechtenstein rejected all these concerns.
c) Infringement of the right of access according to Art. 15 GDPR
c.1. Point 2 (processing purpose) and point 4 (recipient) of the controller’s information
under Art. 15 GDPR from November 2018 co
states that they process personal data solely
in accordance with the screenshot. On and, the controller states in
point 4 that they transfer the personal data to th ccording to the screenshot
for marketing purposes. The information given in p s incomplete. In accordance
with point 4, the transfer of personal data t for marketing purposes should
have been listed in point 2 as further processing of the personal data.
c.2. Point 5 (storage period) of the controller’s information under Art. 15 GDPR from
November 2018 merely states that the data are subject to the statutory retention periods.
The indefinite specification of the retention periods in the context of the provision of
4/4
information is not sufficient. In accordance with the requirements of Art. 15 para. 1 letter
d. GDPR the storage deadlines or the criteria for the determination of this duration in the
provision of information must be specifically stated. It is not up to the person concerned
to check which specific statutory retention periods apply to the processing of his personal
data. The provision of information in point 5 is therefore incomplete.
c.3. Point 7 (right of appeal to the supervisory authority) of the controller’s information
under Art. 15 GDPR from November 2018 states that there is a right of appeal to a data
protection supervisory authority. This corresponds to Art. 15 para. 1 letter f. GDPR. Art. 15
para. 1 letter f. GDPR does not specify with which data protection supervisory authority
the complaint shall be filed. The legislator thus allows the complainant to decide with
which data protection supervisory authority he intends to file his complaint. Some data
protection experts (see for example Kühling / Buchner, General Data Protection
Regulation, 2nd ed., 2018, p. 389 p. 39 in conjunction with p. 423 para ) believe that the
supervisory authority must in any case be specified with regard to the possibility of
lodging a complaint. The DPA Liechtenstein does not fully agree with this opinion though.
The DPA Liechtenstein considers that in principle the complainant is able to judge by
himself which shall be the Data Protection Authority for filing his complaint. In accordance
with the legislator's requirement under Article 12 (1) GDPR that the person responsible for
data processing should facilitate the exercise of his rights in accordance with Articles 15 to
22 of the GDPR, the DPA Liechtenstein pronounces the recommendation, that the
competent supervisory authority or at least the criteria for the designation of the
supervisory authority shall be stated in the controllers’ information pursuant to Art. 15
GDPR. However, there is no legal obligation to do so.