Legal Department
by IMI Date : 2nd October 2019
Contact:
Tel:
Fax:
National
Reference:
Final Decision – Complaint against
- IMI A56ID 55264
- IMI Case Register entry 58950
- IMI A60DD 74979
Dear colleagues,
on 27 August 2019, the above-mentioned draft decision was submitted to the supervisory
authorities that have reported to be concerned. Within the four-week period, no relevant and
reasoned objection was expressed. Therefore the complaint will now be closed without further
actions on the basis of the draft decision cited below. For this purpose, a closing message was
sent to the controller today, which contained the relevant extracts from the draft decision. The
controller was also informed of the note made by the French CNIL on 23rd September 2019
under "Other relevant comments".
I. Submission of the complaint; competence
st
On 31 August 2018, the then 15-year-old complainant filed a complaint against
ith the Austrian data protection authority ("ÖDSB") regarding the
roof of parental consent to raise the complaint at
issue was submitted to the ÖDSB.
is the contractual partner and controller for all (registered) users
on the following websites: With regard to these
websites, maintains its (main) establishment within Europe in
. The website is operated by which is there-
fore not subject to this draft decision.
The signature of customer service messages, as received by the complainant, mentions
owever, this company only provides services on behalf of as
a processor. The , which is also located in , is
therefore not controller with regard to the subject of the complaint to be assessed below. We
have already pointed out to that the signature of the customer service messages should
reflect the relationship more clearly.
2
Since the case could constitute cross-border processing under Art. 4 No. 23 lit. b GDPR, the
ÖDSB initiated an Art. 56 identification procedure (A56ID 63640) in IMI in December 2018 for
further clarification. Due to the controller’s main establishment in
is according to art. 56 GDPR and § 19 Federal Data Protection Act the lead su-
pervisory authority for cross-border processing activities of the controllers. The on-
th
firmed its competence to investigate the case via IMI on 7 January 2019 and created the case
th
register entry no. 58950 on 29 January 2019.
II. Facts of the case
The complaint documents containing the conversation between the complainant and the
customer service show that the complainant requested information about his user account
" on 1 July 2018 via a contact form (please see the complaint attachments up-
th
loaded under “relevant documents”). On 5 July 2018 customer service responded via
e-mail by asking the complainant to verify his identity in order to ensure that the information
was provided only to the data subject.
It is known to the from previous supervisory activities that data access requests can be
submitted to the controller by e-mail, contact form or post; there is not (yet) any possibility of
submitting a request from the user account whilst logged in. in general provides different
modes of identity verification (including telephone verification). In cases where data access of a
certain volume is requested, the user – for different reasons already detailed to us in a previ-
ous case – is first asked to provide verification by means of a redacted copy of his or her ID –
as was the case with the complainant. In such requests for proof of identity it is expressly
pointed out to the user that various specific data fields may be redacted. According to the
current process implemented by the controller since November 2018, all fields may be redact-
ed except name, date of birth, period of validity and address (at the time of the complainant's
request, it had not yet been explicitly stated that photo, title, signature and ID number can also
be redacted). Name, address and date of birth are data categories which asks its newly
registered website users to provide before the and which are verified in the
course of the contractual relationship (depending on the type of user account,
etc.) by different methods (e.g. For the
submission of the redacted copy of the identity document, various options are explained to the
applicants and (since November 2018) indications are given as to the degree of security of the
respective option.
th
The aforementioned e-mail of 5 July 2018 also indicated that the proof of identity and ad-
dress "will be used exclusively for the purpose of identity verification in connection with the
requested data access".
The complainant then passed the requested verification process and received feedback from
st
customer service on 1 August 2018, stating that his user account had been suspended
as there were indications that the complainant had not yet reached the age of majority. For
this reason, the message stated, the company's general terms and conditions did not allow the
complainant According to T&C (as of May 2018)
3
nd
On 2 August 2018, the customer service also informed the complainant (translated by
"Unfortunately we cannot give you the data as things stand because you are not yet of
age. We need your parents' consent, as well as the birth certificate and a copy of your
parents' identity card."
rd
On 3 August 2018, the complainant replied (translated b
"I don't think you've been properly informed. According to the (Austrian) Data Protec-
tion Code, the processing of my data with my consent is legally binding with the com-
pletion of age 14. Therefore I may make dispositions with regard to my data and I urge
you to grant me my right to information. Otherwise, I will seek to complain to the
competent authority."
In the original complaint submitted to the ÖDSB, the complainant described the following in
response to the question as to how the controller had reacted to his request for information
(translated by
"I was told that my account had been deactivated because it turned out during the
processing of my request that I was under the age of majority.
I consider this answer to be inadequate and believe that my rights have been infringed
for the following reasons.
My account has been deactivated although I have only requested information. I have
never intentionally given false information about my birth date. The fact that I made a
request for information was used against me, which is certainly not appropriate."
The case description of the ÖDSB in the A56 identification procedure contains the following
summary:
“On 1 July 2018, the complainant sent a request demanding access for information by
a contact form to the controller. The controller replied to the complainant that he
could not easily provide information because the complainant was not of legal age and
therefore had to provide the controller with the consent of his parents, his birth certif-
icate and a copy of his parents’ identity card.”
th
Following an initial oral request for comment to the company's data protection officer on 15
January 2019, the was informed that does not provide standardized processes for
requests from minors, as such requests could not normally occur because minors are not al-
lowed to register for the service. The customer services demand for further documents was
therefore not a requirement of the company and, from its point of view, under no aspect nec-
essary.
th th
By letters dated 25 February and 7 March 2019, which have been brought to the ÖDSBs
attention, the urned to the German-speaking complainant directly in order to ask further
questions about the subject matter of the complaint. The background is that, from the
perspective, the complaint is not directed against the fact that a birth certificate and copies of
the parents' identity cards were requested, but against the fact that information from the copy
of the identity card was used for comparison with the data stored in the user account and that
the user account was suspended due to the discrepancy found.
th th
On 28 February and 16 March 2019, the complainant informed the that this was the
case (translated by
4
"You have correctly recognized that my complaint is directed against the suspension of
my user account. It is also clear to me that this is not a data protection matter, which is
why this fact is of secondary importance.
I see the data protection problem in the fact that my personal data (the copy of my
passport) have been used contrary to the original purpose. I also disagree with your
statement that I "did not provide the company with the copy of the identity document
merely for the purpose of enabling the information to be transmitted". The above was,
in fact, the only reason I submitted the copy of the identity card. […].“.
rd
I have continued to communicate with the controller since 3 August 2018. You will
find my letter attached. In the meantime, I have also received the requested infor-
mation, [...]."
th
Following a request dated 15 April 2019, took the opportunity to submit its written
rd
comments by letter dated 23 April 2019 (translated by
"Our customer service received s request for information on 01.07.2018 and
requested on 05.07.2018 - according to our standard process - a redacted copy of his
identity card. sent a copy of his passport on the same day. As it turned out that
was a minor and therefore had violated the Terms and Conditions, his
user account was suspended.
We have not corrected the date of birth in the user account. Only an internal note
with the correct date of birth was stored.
After asked on 31.07.2018 about the status of his application, our customer
service requested on 02.08.2018 (unfortunately erroneously) the consent of his par-
ents, as well as copies of the birth certificate and the identity card of the parents in or-
der to be able to give the data information.
After complained about this on 03.08.2018, our customer service became
aware of this mistake and gave the desired information electronically on
16.08.2018. We have not received any further communication from since then,
so we consider his request to be closed. “
Five internal documents, regulating the processes according to which the customer ser-
th
vice is meant to handle access requests, were then made available to the by on 17
May 2019:
(1) Standard procedure for requests for data information (SARs SOP DE 2019),
(2) Subject Access Request Standard (Global 2019),
(3) Subject Access Redaction Guidelines (Global 2018),
(4) Subject Access Exemption Guidelines (Global 2017),
(5) Contact Verification (CV) for telephone/e-mail ( ).
Document (1), in which the processes are described in the most detailed way, contains the
note: (this privacy
team is based in for German cases and at a service company in for other
languages). The list of documents that may be requested from the customer service in
5
addition to or instead of a copy of an identity document only includes powers of attorney of
legal representatives, certificates of inheritance in the event of death or
Birth certificates or identity cards of custodians are not mentioned at any
point. The above-mentioned documents also show the process by which the copies of identity
cards are immediately deleted or destroyed after access to information has been granted (the
was able to convince itself of the practical implementation of these requirements on the
occasion of an on-site meeting). Upon request furthermore informed us that an applicant
will be contacted by telephone (provided a valid number is stored) or in writing if a discrepancy
between the data on the ID copy and the data in the user account is found. If a discrepancy
cannot be resolved and doubts cannot be dispelled, access will not be provided.
III. Legal assessment
The as no concerns that the verification process in its current form and as specified by
the controller for customer service is compatible with the requirements and limits of Art. 12,
15 GDPR.
Before granting access to his information, the complainant initially was asked to verify his own
identity, which he did immediately, without expressing any concerns about the concrete pro-
cedure. The complainant was expressly informed as to which data fields of the identity docu-
ment he could black out before transmission - whether he made use of this is not known. This
is, however, of no relevance for the assessment of the complaint case, since the complainant
objects to the processing of his date of birth, which should remain visible in any case. The data
that was not to be redacted according to the current data access process (name, date of birth,
address) is data that requests from its newly registered website users as a matter of
course, and that it verifies with the help of external sources in the course of the contractual
relationship. With regard to this data, the company therefore has a database of valid user data
to compare to, which means that the verification process carried out is suitable for ensuring
that the account holder and the applicant are identical and that the documents containing the
information requested are only transmitted to an authorized person. Only the period of validity
of the identity card is a new date for the company, the consultation of which is also necessary
and suitable to ensure the aforementioned purpose.
The verification process, which was carried out differently in some details at the time of the
complainant's request, has already been modified by in November 2018 in order to min-
imize the process to the most necessary data and to make it technically and organizationally
more secure.
a. Request for additional documents - Art. 12, 15 DS-GVO
In contrast to the aforementioned verification process, the oes not see on what legal
basis an underage applicant, whose identity has already been determined, could be asked to
furnish additional documents relating to the custodian before information pursuant to Art. 15
GDPR is provided. This query would not be covered by Art. 12 para. 6 GDPR, which allows the
controller to request additional information necessary to confirm the identity of the data sub-
ject in cases of reasonable doubt as to the identity of the applicant. On the one hand a birth
certificate or a copy of a parent's identity card has no influence on whether or not the appli-
cant is the same as the account holder whose data is supposed to be submitted. On the other
hand, in the context of the data access request, there is also no consent required of the custo-
6
dians. It is therefore not apparent that any documents of the custodians fulfil a purpose which
justifies their request by the controller.
In the s opinion this question can ultimately remain unanswered in the specific case.
has provided meaningful documentation to show that the customer service's request to trans-
fer additional documents of the custodians did not comply with the controllers specifications
and instructions. Rather, this was a case of faulty communication by a customer service em-
ployee in a single case. There is no reason for the to doubt the information provided by
the controller, especially since the customer service immediately revised its initial state-
ment following a brief note from the complainant. The requested information then was provid-
ed without any further intermediate steps. Even if one were to assume that for a short period
of time an obstacle for a data subject to assert his rights had been created, it should be borne
rd
in mind that according to his e-mail of 3 August 2018 the complainant was very familiar with
his rights. At no time did he seem to be under the impression that he had to comply with the
request. There was therefore only a hypothetical risk that further data would be transmitted
involuntarily and without necessity in order to obtain data access.
The sees no evidence of a risk of repetition in the sense that obstacles will be wrongly
imposed on other minor applicants before granting data access. The controller has submitted
various internal documents that comprehensively set out the internal requirements for cus-
tomer service with regard to data access requests. These documents do not contain any in-
structions that might give cause for concern.
b. Correction of birthdate/ storage of an internal note - Art. 5, 6 GDPR
Overall the complainant's concerns are solely directed against the individual processing of his
birthdate from his ID. The complainant regards this as a data processing for an unlawful pur-
pose and thus a violation of Art. 6 para. 1 and para. 4 GDPR.
These concerns are not shared by the The deems the described process as – at least
– covered by Art. 6 para. 1 lit. f, para. 4 and Art. 5 para. 1 lit. d GDPR. The controller has re-
quested data from the complainant for an identity verification and compared it with his own
database. The complainant had previously been informed that his copy of the identity docu-
ment would be used for the purpose of identity verification in connection with the data infor-
mation provided. Against this background, the complainant did not simply make the document
available in order to enable the information to be transmitted. This would be the case if some-
one was asked to provide the address on the ID so that it could be used
Rather, the present case concerned the verification of identity, which presupposes the com-
parison and check of identity card and user account data in order to determine that the person
submitting the application is identical to the account holder.
In the complaint case, it became apparent that there was a discrepancy between the date of
birth as it appeared on the ID card and as given by the complainant himself when registering
on the Even though the complainant has stated that he never intentionally pro-
vided false information, false information concerning the date of birth had been deposited in
his user account for reasons which at this point cannot be ascertained anymore.
According to its own security standards, in consequence should not have been able to
grant data access to the complainant because it could not be determined with certainty that
the applicant and the account holder matched up and because there was a risk of unauthorized
7
data transfer to third parties. In order to try to fulfil the complainant’s interest and because in
the specific case no further anomalies were identifiable with regard to the complainant’s user
account, the customer service nevertheless completed the verification solely by means of
name and address matching.
According to Art. 5 para. 1 lit. d GDPR, "personal data shall be accurate and, where necessary,
kept up to date; every reasonable step must be taken to ensure that personal data that are
inaccurate, having regard to the purposes for which they were processed, are erased or recti-
fied without delay ("accuracy")". In view of this principle, after permissible data matching, a
controller may not simply ignore the finding that one of the customer´s data sets must be in-
correct. Otherwise the controller would even risk violating Art. 6 para. 1 lit. b and Art. 5 para. 1
lit. d GDPR. In addition, the date of birth is information which has direct influence on the con-
tractual relationship as the company according to its T&Cs expressly excludes minors from
In the present case circumstances made it obvious that the birthdate
in the ID had to be the accurate date. In order not to avoid violation of the accuracy require-
ment of the GDPR and to enforce the controller’s own T&Cs, the actual birthday from the ID
as well as the information that it does not coincide with the date indicated at the time of regis-
tration has been stored by , together with the consequence of the account suspension.
Instead of immediately rectifying the data stored in the user account, only an internal note was
created to alert the complainant to the suspicion and give him the opportunity to clarify.
st
Finally, the complainant's request for information of 1 July 2018 was also answered in due
time within the meaning of Art. 12 para. 3 GDPR. In the absence of any indication to the con-
trary, it can be assumed that the information was provided in a satisfactory manner.
IV. Decision
Based on the foregoing facts of the case and legal assessment, the considers the investi-
gation procedure to be completed. In summary, no ongoing violation of the provisions of the
General Data Protection Regulation could be found. As the complaint has only limited personal
impact and due to the measures already taken by to improve the data access process, the
does not regard as necessary any further action according to Art. 58 para. 2 GDPR.
Therefore, the cross-border complaint is hereby closed.
On behalf of the