FINAL DECISION
Reprimand for failure to comply with the requirements of the General Data Protection
Regulation
Notice of termination of proceedings in a matter concerning the Electronic
Communications Act
A complaint from person and perso forwarded by the French
supervisory authority is currently processed by the Estonian Data Protection Inspectorate.
has carried out an investigation within your company due to an inquiry from the Estonian Data
Protection Inspectorate.
During the proceedings, you responded to the Inspectorate’s inquiries as follows:
Yes, the is a self-employed person engaged in the relevant economic and professional
activities, and the necessary
registration is required.
The persons who filed the complaint had joined the platform as persons carrying out
economic and professional
activities.
a) provides service as a person engaged in economic or
b) provides service on platform through the following
company:
For internal investigation, we need additional information about the time of sending the
forwarded text messages in order to send the relevant inquiry to the partner whose channels
were used to forward the messages. We have informed and communicated with the partner
about this case.
For information, usually sends two types of messages :
A request for terminating the registration is sent if it is pending due to the submission of
documents. We invite when demand increases and
We started by sending an inquiry to the partner, because if the stop number was answered
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registry code 70004235
correctly as it should be, the number should also have immediately reached the message
blocking list. There is no information on when messages were exchanged and when the STOP
inquiries were made.
All communication towards the is related to the provision of services within economic
and professional activities, in order to perform the contract.
We confirm that the account of has been deactivated and
unnecessary personal data has been deleted as of 2018-08-26.
The partner has been informed about the text message received with the STOP content. An
investigation is ongoing with the partner and we expect to receive a response by 26/06/2019.
We have received from our data processor an extract about the operations performed on these
numbers.
The messaging service provider of said that the situation arose due to technical limitations,
where the processing of the STOP message was implemented only with regard to one account
(from where the message was sent) in their internal system but was not implemented with regard
to the global number. The service provider is resolving the matter, so that when the client sends
a STOP message, it would be implemented across accounts. Until the service provider
implements the updates in the system, uses accounts at the relevant service provider
without global numbers.
Of the two documents added to the additional inquiry, we will continue to investigate “French
complaint 18017409.jpeg” in cooperation with our messaging service provider. At the moment,
the messages indicate that the has sent a STOP request to number and has received
a confirmation message from the messaging service provider, but based on several STOP
messages sent by the client, it can be presumed that the person has not understood the purpose
of the confirmation message and has incorrectly deemed it to be a marketing message.
has communicated with the technical SMS platform service provider about the weaknesses
of the platform. At the time of writing this letter, we have received approval from their client
manager to further implement the STOP message across accounts, including to a global
number.
confirmed that the account of has been deactivated and the non-
essential personal data have been erased as of 26 August 2018. During the last inquiry of the
inspection, the Inspectorate asked to be provided an estimated time when the service provider,
that means the contracting partner of will have resolved the processing of messages
(implementation across accounts).
The Data Protection Inspectorate finds that the data controller and processor have solved the
problems – a person’s account has been deleted and, in regard to the second person, the
circumstances have been determined in relation to sending the STOP message. The data
controller has also implemented the corresponding changes in regard to its contracting partner
that means in relation to the message services.
I shall issue a reprimand to in accordance with Article 58 (2) (b) of
the General Data Protection Regulation and draw attention to the following:
1. When processing personal data, the data controller shall ensure that processing is lawful,
fair and transparent to the data subject (Article 5 (1) (a) of the General Data Protection
2 (3)
Regulation). It is also important that persons are not provided with misleading
information concerning the processing of personal data (including deletion of data). The
outgoing messages of should be clear and understandable with regard to their
content.
2. The data subject shall have the right to obtain from the data controller, without undue
delay, the deletion of (the account), other personal data concerning this person, and the
personal data shall be subject to immediate deletion if there is no legal basis for further
processing of data (Article 17 of the General Data Protection Regulation).
In view of the foregoing and the fact that the personal data of persons and
have been deleted (the account) and the data controller has unambiguously and
clearly explained the content of the sent text message, I shall terminate the supervision
proceedings in this matter.
Respectfully
Senior Inspector
authorised by Director General
3 (3)