Pazarlama İletilerine İtiraz ve İşbirliği

Information and Data Protection Commissioner

Vs

COMPLAINT

Reference is made to the complaint (registered internally with file number CDP/IMI/LSA/27/2018)

received from the Berlin Commissioner for Data Protection and Freedom of Information (the

"concerned supervisory authority" or "CSA") concerning ("the complainant") who is

alleging that ("the controller" or " ") breached his data protection

1
rights, as enshrined under the General Data Protection Regulation ("GDPR" or the "Regulation"). The

complainant contended that the controller was still processing his personal data for the purposes of

sending him marketing communications despite the fact that he has revoked his consent.

In particular the complainant wanted to have confirmation from the data controller that his first email

1h
dated 30 November, 2 0 1 7 , by which he revoked his consent to use both his email addresses and his

mobile phone number for the purpose of sending marketing communication, had been received by the

controller.

It has to be noted that when the complaint was lodged for the first time with the Office of the Information

and Data Protection Commissioner ("IDPC" or "Commissioner"), on the 13th of September 2 0 1 8 , the

IDPC requested the controller to confirm that its main establishment was in Malta. Despite the

controller's positive answer, following a preliminary investigation, it transpired that the controller had

just an office registered in Malta but it did not have its main establishment within the Maltese territory.

The CSA was informed of this outcome of the preliminary investigation.

On the 23rd July 2 0 1 9 the CSA informed this Office of the change of the data controller's registered

address. From an unannounced IDPC visit to the new data controller's premises to deliver a request for

submission by hand, it transpires that currently the controller has an office and some employees in

Malta. However, during this visit it was not possible to establish whether the Malta office is in fact the

1
Regulation ( E U ) 2016/679 on the protection of natural persons with regard to the processing of personal data

and on the free movement of s u c h data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Airways House, Second Floor \.. (+356) 2 3 2 8 7 1 0 0

High Street, Sliema SLM I S tJ 9 � [email protected]

MALTA. e www.idpc.org.mt

---

controller's main establishment as when we asked for the data protection officer, at that time, he/she

was not present.

INVESTIGATION

As part of the investigation process, on the 1 3 t h of September 2 0 1 8 the Commissioner requested the

controller through an email to confirm that its main establishment was in Malta. Following its positive

reply, the Commissioner requested the controller to put forward its submissions on the allegation raised

by the complainant, through a registered letter dated 1 1 t h October 2 0 1 8 . As the submissions, that were

received through email, only contained information that was already known, which was part of the

complaint, further submissions were requested on the 25th of March, 2 0 1 9 . In view that no reply was

forthcoming, a reminder in the form of registered mail was sent on the 3th April, which according to

MaltaPost plc, was not delivered "due to addressee not available". Eventually our investigations led

to another different e-mail address for the controller, and another e-mail was sent on the 23rd of April.

A reply was received through email on the 2nd of May, 2 0 1 9 . Further documentation was requested on

1
the 26 h July 2 0 1 9 to which a reply was received on l st of August, 2 0 1 9 .

The Commissioner notes that the long time it has taken for the Controller to be contacted and eventually

reply to all the requests made by his Office, and the fact that even though the Commissioner had to

resort to using registered mail and still no reply was forthcoming, it is being highlighted that the

controller's degree of cooperation with this Office is not in line with what is expected under the GDPR.

The submissions included the following principal arguments:

The controller confirmed that they were not able to find the first email sent by the complainant

on the 30th of November 2 0 1 7 on their server, and therefore cannot confirm whether this email

was ever received or otherwise. The controller also stated that there is a possibility that the

email, in case it was received, was not dealt with properly and, this might be the reason why it

is not stored on its system. In any case the controller did not comply with the complainant's

request within the legal time and, as a consequence, the complainant was still receiving

1
marketing communications after the 30 h of November, 2 0 1 7 ;

For privacy and security reasons the controller requires registered customers to get in contact

by using the email address provided when opening their accounts. The email address used by

the complainant when opening his account was . When sending the email

on the 30th of November, the complainant used this email address. It has to be noted that the

complainant has other four (4) email addresses namely: j ,

---

idll�
that are not linked to his account

with the controller;

The controller confirmed that they were able to identify sixteen ( 1 6 ) cases in which marketing

communications were sent to the email address after the 30th of

November, 2 0 1 7 . Besides these sixteen cases the controller was not able to find any other

marketing communication sent to the complainant, neither before the 30th November, 2 0 1 7 , nor

after;

It has to be noted that the complainant is claiming that the controller has used his personal data

(email address and mobile number) to send him marketing communication after the 30th of

November, 2 0 1 7 , which amounted to between forty two (42) and forty five ( 45) instances. The

complainant provided this Office with a copy of the marketing email received on June 11th

2018;

From the submissions dated 2"d May 2019, it transpires that after having re-assessed its

communication system the controller was not able to find any marketing communications sent

to any of the other email addresses pertaining to the complainant and not associated to his

account with the controller, thus the controller is of the opinion that such emails have not been

sent;

Following the receipt of the marketing communications after the 30th of November, 2 0 1 7 , the

complainant sent various emails to the controller soliciting to stop sending unsolicited

marketing communications. In sending these emails the complainant randomly used all his

email addresses mentioned above, and not only the email address he used to open his account.

As a consequence, according to the initial controller's submissions, the controller was not able

to identify the complainant and thus could not satisfy his requests;

On the 24th of June, 2 0 1 8 , the complainant sent a further email to the controller requesting once

more to stop the processing of his personal data for the purpose of sending marketing

communications. Despite the fact that the email was sent using the email address

(and not the email address used by the complainant to open his account),

on the 25th of June, 2 0 1 8 the controller blocked the complainant's account from receiving any

marketing communications. After this date no marketing communications have been sent to the

complainant by the data controller;

The controller has revised, redesigned and implemented internal procedures relating to the

handling of data subject right requests.

---

id�c.
IFWO�DN AHO DA.
T A,

PjlQlECT!OH CID..UK...s:t
ruiE�

DECISION

On the basis of the foregoing, the Commissioner considers that the data controller did

not have adequate procedures in place to deal with the complainant's request to exercise

his right to object to processing operations, resulting with the complainant actually being

deprived of this right. Furthermore, the Commissioner views that there was lack of co­

operation in dealing with this case. Subsequently the controller is found to be in violation

of Articles 21 and 31 respectively of the GDPR, and after giving due regards to the

circumstances contemplated under Article 83.2 of the GDPR and taking into account

Article 83.1, is hereby being served with an administrative fine

of fifteen thousand Euro (€ 15,000).

The Commissioner also considers that the controller's inability to deal with the data

subject's complaints, in particular, the lack of procedure to handle the right of erasure

request, led to the sending of unsolicited communications to the complainant. The

controller is therefore also found to be in breach of regulation 9 of Subsidiary Legislation

586.01 of the Laws of Malta and pursuant to regulation 13 thereof, the data controller is

hereby being served with an administrative fine of two thousand Euro (€ 2,000) for this

violation.

The administrative fines shall be paid to the Commissioner within twenty-five (25) days

from receipt of this decision.

A copy of this decision is also being sent to the Berlin Commissioner for Data Protection and

Freedom of Information

Information and Data Protection Commissioner

Today, the day of October 2 0 1 9