OFFICE FOR PERSONAL DATA
PROTECTION
Pplk. Sochora 27, 170 00 Prague 7
tel.: 234 665 111, fax: 234 665 444
[email protected], www.uoou.cz
Ref No. UOOU-03390/19-7
ORDER
The Office for Personal Data Protection, as the competent administrative authority pursuant
to Article 58 (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive 95/46/EC (General Data
Protection Regulation), and Section 60 of Act No. 110/2019 Coll., on the personal data
processing, decided on 7. October , in line with Section 150(1) of Act No. 500/2004 Coll.,
the Code of Administrative Procedure, as follows:
Party to the proceedings: a company with its registered seat
at , has been imposed,
in connection with the processing of the personal data of debtors, specifically the publication
of such data on the website or on the website
the following obligation:
I. To cease processing the personal data in the form of the publication of such
data, and remove the already published personal data,
within ten business days of this order entering into force.
II. To submit to the Office for Personal Data Protection a report on fulfilment of the
imposed measure specified in point I of the operative part hereof,
within five business days of the date of fulfilment of this imposed obligation.
Reasoning
The documents collected by the administrative authority when compiling File
No. UOOU-03390/19, comprising in particular the documents collected by the Slovenian
Supervisory Authority and the materials obtained by the Office for Personal Data Protection
(the “Office”), in line with Section 3 of Act No. 255/2012 Coll., form the basis for issuing this
order.
On 5 July 2019, in the Internal Market Information System (“IMI”), the Slovenian supervisory
authority proposed that the Office be the lead supervisory authority pursuant to Article 56 of
Regulation (EU) 2016/679 (procedure A56ID 71098) for the respective processing. On 22 July
2019, the Office accepted the role of lead supervisory authority.
1/6
The administrative authority bases point I of the operative part hereof, by which the party to
the proceedings is imposed the obligation to cease processing the personal data of the
of the party to the proceedings in the form of the publication of such data, particularly via the
website or the website
and arrange for
the removal of the personal data that has already been published, on the facts set out below.
The operator of the is the party
to the proceedings, a company with its registered seat
at registered
in the Commercial Register maintained by the
the executive officer of which is born DD Month YYYY, residing
at Address Number, Post Code, Town (according to the findings of the Slovenian supervisory
authority, he was living at the time in , with the company’s line of business
being the lease of real estate, flats and commercial premises, and production, sale and
services not listed in Annexes 1-3 of the Trade Licencing Act (see Ref. No. UOOU-03390/19-3
in this respect). Specifically, the party to the proceedings is involved in
(see
Ref. No. UOOU-03390/19-3 in this respect).
The subject-matter of these proceedings is the fact that the party to the proceedings
publishes, in addition to its own advertising, the personal data of debtors on its
in the extent of the first
letter of each debtor’s first name and entire last name as well as the amount of the debt in
the currency of the EU, e.g.: dolžnik N. Surname, 43000,-€; dolžnik N. Surname, 23000,-€.
It is clear from the file documents that the described actions of the party to the proceedings
has resulted in the publication of information about natural persons, i.e., personal data
in accordance with the definition set out in Article 4(1) of Regulation (EU) 2016/679. Pursuant
to this provision, personal data is understood as any information relating to an identified or
identifiable natural person (‘data subject’). Although the party to the proceedings does not
publish all of the identification data, it is clear to the Office that the persons listed
here may be directly or indirectly identified based on the published information. In this
context, it should be added that in the situation where the identity of a specific natural person
is known, it is necessary to consider any other information that can be linked to this person
(e.g., debt amount) to be personal data.
As already mentioned, the party to the proceedings publishes on its
the personal data of in the extent of an abbreviated first name and the entire surname
as well as the person’s status as a . The
party to the proceedings possesses the respective information due to its business activities:
The party to the proceedings thus publishes through its internet nformation
about specific cases where it is the or, more precisely,
The administrative authority thus considers it proven that the party to the proceedings is, in
relation to such information, the personal data controller in accordance with Article 4(7) of
Regulation (EU) 2016/679, as within its business operations it determines the purpose and
2/6
means of the respective personal data processing. Therefore, the party to the proceedings is
subject to all the obligations that stem from Regulation (EU) 2016/679 based on this status.
The basic obligation of personal data controllers is for them to have legal title to process
personal data in accordance with the requirements expressed in Article 6(1) of Regulation
(EU) 2016/679. With regard to the nature of the respective processing, it is the opinion of
the administrative authority that only the legal title of consent under Article 6(1)(a) of
Regulation (EU) 2016/679 could generally be applicable. It stems from the file documents,
however, that the complainants, as the affected entities, called attention to the fact that
the personal data was published despite not having given consent to such publication (see
Ref. No. UOOU-03390/19-1 in this respect). For the sake of completeness, the administrative
authority states that consent, if granted, should fulfil the requirements placed on informed
consent pursuant to Article 7 of Regulation (EU) 2016/679. In similar situations, it is, however,
with regard to the degree of interference with the data subjects’ rights, highly unlikely that
such consent – which is, in particular, free and unconditional and clearly distinguishable from
other information – would be obtained.
For the sake of completeness, the administrative authority states in relation to the legal title
of legitimate interests under Article 6(1)(f) of Regulation (EU) 2016/679 that not even this
legal title applies to the party to the proceedings. Processing based on this legal title must be
necessary for the purposes of the legitimate interests of the respective controller or third
party; furthermore, the condition that the cases in questions are not those where the interests
or basic rights and freedoms of the data subjects (requiring the protection of privacy and
personal data) take precedence over these interests must be fulfilled. The controller’s
legitimate interests must first be lawful, i.e., in compliance with legal regulations, and clearly
formulated (not speculative). The controller’s legitimate interests also include economic
interests, i.e., interest in securing the economic side of its business operations. The party to
the proceedings in such case could claim and demonstrate legitimate interests (e.g., more
effective debt collection or marketing). The publication of the
including the outstanding amount, could explain the to the proceedings
to potential customers, i.e., the seller of the debt, and could force the debtor, through public
defamation, to settle the debt. The controller’s legitimate interests are, however, insufficient
to allow the application of Article 6(1)(f) of Regulation (EU) 2016/679.
In considering legitimate interests, it is also necessary to assess whether the respective
processing is necessary to fulfil these legitimate interests, i.e., whether it is not possible to
achieve the same result by processing a narrower scope of personal data or infringing to
a lesser degree on the data subjects’ rights. Besides, minimisation of data is a basic principle
of personal data processing and is currently expressed in Article 5(1)(c) of Regulation
(EU) 2016/679. In countries where the rule of law applies, ust, however, be
carried out in a way foreseen by law and not by public denunciation of the debtors. The party
to the proceedings thus has other means at its disposal that would allow it to fulfil its
legitimate interest and infringe less on the data subjects’ rights. In the administrative
authority’s opinion, processing in this form is not necessary to attain the controller’s or third
parties’ legitimate interests.
For the sake of completeness, the administrative authority states that if the respective
processing indeed was necessary to achieve the legitimate interests, in the context of
balancing the interests it would be necessary to balance whether the data subjects’ interests
3/6
and basic rights prevail over the controller’s legitimate interests. In doing so, it would be
necessary to take into account the nature and importance of the controller’s legitimate
interests, the impact of the respective processing on the data subjects, including the data
subjects’ reasonable expectations, and any other protective measures applied by
the controller. The degree of interference with the data subjects’ rights is then dependent on
the nature of the published information (i.e., and on the content of this
information . Publication of information about a specific person being
does, however, represent a significant risk in the form of an adverse impact on
the rights of these persons in both their personal life and work life. Such information can lead
to social exclusion of such persons and their family members, loss of employment and other
negative implications. Publication of negative information of
a person thus constitutes such an infringement of the data subject’s rights that the simple fact
that the respective data subject
do not justify such processing. The is not
authorised to publish a personal data each time a In this respect,
it is necessary, in line with recital 47 of the Regulation (EU) 2016/679, to also take into account
the data subjects’ reasonable expectations stemming from the fact that the information being
published by the party to the proceedings is usually information that is not disclosed. It is in
the administrative authority’s opinion that the respective processing is not foreseeable by
the data subjects. Infringement of the data subjects’ rights is also heightened by the fact that
publication of information on the publication on the Facebook profile of the party to
the proceedings is clearly not limited in time in any way (or it is apparently limited only at
the discretion of the party to the proceedings). Moreover, over time, the intensity of
the infringement of the data subjects’ rights continues to increase. The administrative
authority is thus of the opinion that under the same facts, the interests of the controller or
any third parties would also be outweighed by the data subject’s interests and basic rights and
freedoms requiring protection of personal data.
After the summary assessment of the above facts, the administrative authority states that in
the case of the systematic publication of information about under the same
circumstances, the interests of the controller or any third parties are generally outweighed by
the rights of the affected For such processing, the legal title of legitimate interests
under Article 6(1)(f) of Regulation (EU) 2016/679 cannot be claimed by the controller.
Based on the collected documents and publicly available information, the administrative
authority has sufficient supporting material to assess the legitimacy and legality of
the respective actions of the party to the proceedings. As mentioned above, the legal titles
under Article 6 of Regulation (EU) 2016/79 cannot be applied to the processing being carried
out by the party to the proceedings, and the party to the proceedings has thus breached
the controller’s obligations stemming from Regulation (EU) 2016/679 in relation to
the debtors’ personal data.
Based on the above-described complaints and other supporting materials collected from
publicly available sources, the Office has reached the conclusion that in the case at hand, there
is no reason to commence an inspection pursuant to Act No. 255/2012 Coll., as all of
the significant facts and circumstances of the personal data processing have been ascertained
in this matter and conducting an inspection at the party to the proceedings would not lead to
a collection of other supporting materials essential for assessing compliance of the processing
with the requirements of Regulation (EU) 2016/679. A breach of the obligations stemming
4/6
from Article 6 of Regulation (EU) 2016/679 was ascertained in the way described above; and,
therefore, it is possible in compliance with Article 58(2) of Regulation (EU) 2016/679 and
Section 60 of Act No. 100/2019 Coll., to impose the action to remedy the deficiencies
identified and set out a deadline for doing so.
Due to the absence of a legal title, it is necessary to cease immediately the processing of
the personal data for the purpose of publishing such data and to remove the personal
data that has already been published. The administrative authority is of the opinion that
ceasing the processing of personal data without legal title and securing the published personal
data are not tasks that require the stipulation of a longer deadline. For this reason,
the administrative authority has decided in the way set out in point I of the operative part
hereof.
With regard to point II of the operative part hereof, by which the administrative authority
imposed on the party to the proceedings the obligation to inform the administrative authority
about fulfilment of the measure to remedy the deficiencies specified in point I of the operative
part hereof, the administrative authority states that it considers the stipulated deadline of five
business days to be reasonable, as providing information about the adoption of measures
to remedy the deficiencies is a simple task that is not time demanding.
In accordance with Section 150(1) of the Code of Administrative Procedure, the administrative
authority considers the ascertained facts to be sufficient to impose the measure on the party
to the proceedings to remedy the ascertained deficiencies in the extent set out in
the operative part hereof.
Cross-border processing of personal data and adoption of a decision
Personal data processing carried out by the party to the proceedings is, in accordance with
Article 4(23)(b) of Regulation (EU) 2016/679, cross-border processing, as it is likely that
the data subjects of more than one EU Member State will be affected by such processing,
specifically the data subjects in those countries where the party to the proceedings provides
its services.
The inspected party’s main establishment in accordance with Article 4(16)(a) of Regulation
(EU) 2016/679 is, in relation to the processing that is the subject of the proceedings,
i.e., the processing of data subjects’ personal data for the purpose of publication thereof,
is located in the Czech Republic,
The Office is thus the lead supervisory authority in accordance with Article 56(1)
of Regulation (EU) 2016/679 for the personal data processing within the subject of
the proceedings.
Of the countries of the European Union and the European Economic Area, the party to
the proceedings provides its services in the
(see Ref. No. UOOU-03390/19-1 and Ref No. UOOU-03390/19-3 in this
respect). The supervisory authorities of these European Union Member States are, therefore,
in the position of the supervisory authorities concerned pursuant to Article 4(22) of Regulation
(EU) 2016/679.
In accordance with the first sentence of Article 60(3) of Regulation (EU) 2016/697, the Office
has provided the supervisory authorities concerned with all relevant information. In line with
the second sentence of Article 60(3) of Regulation (EU) 2016/697, the draft decision was
5/6
submitted to the supervisory authorities concerned via the IMI system (procedure A60DD)
on 22. August 2019.
The respective draft decision was approved in line with Article 60(6) of Regulation
(EU) 2016/679 and as such is binding for the involved supervisory authorities.
With regard to the above and in line with Article 60(7) of Regulation (EU) 2016/679, it was
decided as is set out in the operative part hereof.
Information: In line with Section 150(3) of the Code of Administrative Procedure, an appeal
against this order can be lodged with the Office for Personal Data Protection within eight days
of its delivery, by which the order shall be cancelled and the proceedings made to continue.
This order shall be deemed delivered on the day that its copy is received, but no later than on
the tenth day of its being handed over to the postal services operator for delivery. In the event
of delivery to a data box, the order shall be deemed delivered at the moment the authorised
person logs in to the data box, but no later than on the tenth day of its delivery to the data
box.
Prague, 7. October 2019
Inspector
6/6