Translation from Latvian
/Coat of arms of Republic of Latvia/
Data State Directorate
Blaumaņa iela 11/13-15, Riga, LV-1011, telephone 67223131, fax 67223556, e-mail [email protected], www.dvi.gov.lv
Case No.L-2-4.3/4627
Decision
Riga,
8 November 2019 No.2-2.2/45
On imposition of administrative penalty
1. Institution (official) adopting the decision: (hereinafter—the
Official), the Head of Personal Data Processing Supervision Department of the Data State
Inspectorate (hereinafter—the DSI) in accordance with the DSI order No.1-2.1/120 of
28.11.2018 “On examination of the administrative infringement case”, Article 58(2)(i) of the
General Data Protection Regulation1 (hereinafter—the GDPR), Section 5(1)(2) of the Personal
Data Processing Law (hereinafter—the PDPL) and Section 236.10 of the Latvian Administrative
Violations Code (hereinafter—the LAPC).
2. Case examination date: 08.11.2019
3. Data about the person the case applies to: Limited Liability Company
, registration number (hereinafter—SIA).
SIA representative did not appear at the case examination. The official finds that on
08.11.2019, the DSI received an e-mail of 07.11.2019 supposedly from the representative of SIA
(DSI, 08.11.2019, reg. No.2-4.3/1854-S) with the information and
requests made in it. The letter did not contain a request to postpone the case examination.
In accordance with Section 4(1) and (2) of the Law On Legal Force of Documents, in
order for a document to have legal force the name of the authors of the document, the date of the
document and the signature shall be included. The document having no legal force is not binding
on other organisations and natural persons, yet it is binding on the author of the document.
The Official finds that the Letter is not signed in person, as well as is not signed with a
secure electronic signature. Therefore, the letter has no legal force and the DSI is not bound by
it.
In light of the foregoing, the Official recognises that no conditions have been stated,
which would be the basis for the postponement of case examination, it is therefore possible to
examine the case without participation of the person called to administrative liability.
4. Summary of circumstances identified in case examination:
4.1. The Official finds that administrative infringement case files (hereinafter—Case
Files) contain a complaint of of 22.08.2018 with an annex transferred by the
Spanish data protection authority (hereinafter—the Complaint).
The DSI finds that it follows from the Complaint and the information available in the
annex that on 10.07.2018, , the citizen of the Kingdom of Spain, purchased
1 Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General
Data Protection Regulation)
Translation from Latvian
2
for EUR 44.00 in online store , which is confirmed by
invoice No (hereinafter—the Invoice). It follows from the Complaint
that in order to receive the product, placed an order of the product on
and transferred his personal data, namely, name, surname and mobile phone
number. In his Complaint, refers to the GDPR, Chapter III, “Rights of the data
subject”, which provides that where personal data relating to a data subject are collected from the
data subject, the controller shall, at the time when personal data are obtained, provide the data
subject with all information on the contact details of the controller or the data protection officer,
the purpose of the use of the personal data, the category of the personal data collected by the
company, the legal basis for the processing of the personal data, the period for which the
personal data will be stored, the third party to which the personal data are disclosed, if the
personal data are transferred to a foreign recipient within the EU, the rights of the personal data
subject. It follows from the Complaint that prior to completing the order form on
was deprived of the opportunity to read the above-mentioned information
and at the same time has a section called Privacy Policy2, where the
information provided does not meet the GDPR requirements.
The Official finds that the annex to the Complaint contains an Invoice issued to
for the sale of . According to the Invoice, is specified
as the seller, but , is indicated as the address of the seller
of the goods. (DSI 02.01.2019 reg. with No.1-5.2/149-S)
The Official finds that in light of the foregoing, based on the consistency mechanism
referred to in Article 63 of the GDPR, the DSI opened an investigation regarding the personal
data processing referred to in the Complaint.
4.2. The Official finds that the Case Files contains the DSI statement of 10.01.2019 with
annex No.7-5.1/1. It follows from the information included in the statement and the annex that
DSI officials, having collected the publicly available information about , learned that
is a food supplement registered in the Register of Food Supplements of the Food and
Veterinary Service of the Republic of Latvia under No. and this product was produced in
the EU at the commission of SIA. (hereinafter—Statement No.1)
4.3. The Official finds that the Case Files contain information from the Register of
Enterprises on Lursoft that SIA is registered at . In accordance with the
information from the register, the type of activity of SIA is retail sale via mail order or via
Internet.
4.4. The Official finds that the Case Files contain a statement of DSI of 25.01.2019 with
annex No.2-5.1/19. It follows from the information included in the statement and the annex that
DSI officials checked the websites and and it has been
stated that the information available on the websites provides evidence of distribution of
. The visual examination has revealed that the websites have an electronic order
window. Persons should specify their name and phone number when submitting an order. These
websites have a similar layout and the type of use. These websites contain privacy policies
having the same content and location and the privacy policy of corresponds
to the one indicated in the Complaint of . The reference to
appears at the bottom of each website.
The examination has also revealed that offers an opportunity to select
a country, for example, Germany, Portugal, Czech Republic, Lithuania, Poland and other, as a
result, depending on the selected country, the websites offer information about in the
language of the selected country without changing the visual layout of the website. The reference
to appears at the bottom of
each website. (hereinafter—Statement No.2).
2
Translation from Latvian
3
4.5. The Official finds that the Case Files contain the reply letter No.02/2019 of SIA
of 22.03.2019 to the DSI’s request on the data processing performed by SIA, where SIA, inter
alia, explained that [..] SIA performs its activity in the following form: An agreement has been
concluded with an advertising company on placement of advertisements of goods in mass media.
A proper agreement has been concluded with a call centre, employees of which receive and
process calls from potential customers based on the advertising information. Information and
needs of customers are transferred to the warehouse of SIA, which processes orders. The
delivery of the goods takes place using a courier service, with which a respective cooperation
agreement has been concluded. [..]
All cooperation agreements and processes will be reviewed during the audit in the
nearest time. When the audit is over, under a contract, an action plan will be developed,
processes and internal regulations will be introduced ensuring the fulfilment of the requirements
for personal data protection in accordance with the requirements of Regulation”. (DSI
26.03.2019 reg. under No.2-4.3/483-S) (hereinafter—Explanation No.1).
4.6. The Official finds that the Case Files contain the reply letter of SIA of 17.05.2019 to
the DSI’s request on the data processing performed by SIA, where SIA explained that [..]
Personal data collection, recording, organisation, storage, consultation, use, disclosure and
erasure (destruction) is carried out by SIA in accordance with Article 4(2) of the GDPR.
SIA has the following personal data about customer: name, surname, telephone, delivery
address.
In accordance with Article 6 of the GDPR, the legal basis for collection, recording,
consultation, use of personal data processed by SIA, when sending, is fulfilment of remotely
concluded agreements towards the data subject on the basis of a cooperation agreement of SIA
with the customer attraction company (call centre) (pursuant to Article 6(1)(b) of the GDPR),
the party to which the data subject is. Furthermore, storage and erasure of respective data takes
place in accordance with the record-keeping and archiving requirements set in the country, as
well as the fulfilment of accounting, which are in accordance with Article 6(f) of the Regulation.
The purpose of each processing of data by SIA is the fulfilment of legal regulations and
assumed contractual liabilities towards the data subject by delivering the ordered goods.
Taking into account that the collection of personal data takes place through mediation to
fulfil the distance agreement concluded with the data subject and the fact that the data are
obtained by the company, with which SIA has concluded an agreement (call centre), then the
respective service providers (call centres) inform customers of SIA on the performed personal
data processing and the conditions defined in Article 14(5)(a) and (b) of the GDPR are applied
when the company obtains personal data.
In addition, SIA explained that currently it is being subject to reorganisation and a
proper personal data processing policy is being developed, as a result of which the information
will be published upon completion of this process. [..] In any case, if the data subject would
submit a request fulfilled in accordance with the requirements of Article 15 of the GDPR, then
SIA would kindly provide a proper reply.
With regard to SIA explained that [..] is an
advertising web page about the product of SIA developed on the instruction of SIA based on a
contract, where it is possible to order a call-back from the customer centre (call centre) of the
cooperation partner of SIA, which also receive data entered there using certain organisational
and technical solutions at any time. (DSI 20.05.2019 reg. No.2-4.3/791-S) (hereinafter—
Explanation No.2)
4.7. The Official finds that the Case Files contain the DSI statement of 29.05.2019 with
annex No.2-5.1/116. It follows from the information included in the statement and the annex that
the DSI officials visually inspected the website and this website contained
information about and an electronic order window for persons. Persons should specify
their name and phone number when submitting an order. Clicking on the Privacy Policy window
Translation from Latvian
4
at the bottom of the website, information on protection of personal data is available. This
information is identical to the one indicated in the Complaint, namely, the one posted on
. When clicking on the Report window at the bottom of the website, it has
been stated that the website contains a communication tool, where a text message can be left (for
example, feedback can be provided or a question can be asked indicating the person’s name
and/or surname, phone number and e-mail. The reference to
appears at the bottom of the website. (hereinafter—Statement
No.3)
4.8. The Official finds that the Case Files contain reply letter of SIA of 21.06.2019 to the
DSI’s request on the data processing performed by SIA, where SIA explained that [..] SIA
cannot answer the question regarding the information about
, on , because SIA was not the developer of
that website. SIA concluded an agreement with on the development of this website,
on provision and development of advertising of products produced by SIA, in this case ,
which provided that was entitled to involve third parties for such activities. SIA
assumes that in that case involved as a third party for the
development of advertising and software. [..]
The annex contains the Agreement No. concluded between
SIA and on provision of marketing services. The agreement states that
provides SIA with advertising services, which under this agreement are the services that ensure
posting of materials raising public awareness of SIA on the internet on its websites, which are
selected by SIA (Sub-Clauses 1.1 and 1.2 of the Agreement). The advertising and information
module is static (with a static image) or animated, graphic information block and/or information
block containing text of any form and layout (section—general designations). The agreement
does not contain conditions for the processing of personal data.
SIA explained that [..] The information entered on the website and data entered on it
(country, phone No. and name) are operated by SIA product distributors and providers of
marketing services, with whom SIA has concluded agreement. Therefore, data entered on the
website are processed by and
(hereinafter—marketing companies), who further perform processing and use of these data for
marketing and product distribution purposes. Only when the marketing companies have
concluded a distance agreement with the customer and obtained necessary data from the data
subject on contact information for sending the product (name, surname, address, phone No.),
information on the need to deliver the product is transferred to SIA in accordance with
concluded agreements [..].
The annex contains Agreement No. and Agreement No
on provision of telemarketing services, which were concluded between SIA and
and SIA and respectively. Sub-Clause 1.1
(Subject matter of the Agreement) of both agreements provides that the companies undertake to
provide telemarketing services (services related to distribution of SIA goods using phone
communication services), while SIA undertakes to accept provided services and pay for them
properly. When selling products, the operator should use proper conversation scenarios issued by
SIA. Each conversation scenario is considered an annex to this agreement and its integral part.
Whereas Clause 5 of both agreements lays down confidentiality obligations, inter alia, Sub-
Clause 5.4 provides that information received by the operators as part of provision of the service,
shall be deemed confidential and property of SIA. Transfer of information (all or partial) to third
parties without written consent of SIA shall be prohibited (a fine of EUR 5000 is set for the
infringement). The content of the agreement corresponds to the agreement concluded between
the controller and the processor.
SIA explained that [..] For the purpose of fulfilment of the product delivery agreement
personal data are entered and processed by marketing companies, which are entered by
Translation from Latvian
5
representatives of marketing companies (operators) in software of SIA. SIA has the
following data on purchasers of products (concluded distance agreements): name, surname,
delivery address and phone No., no other data about customers of SIA are obtained from
marketing companies. SIA does not process e-mails of data subjects. SIA is the controller of the
above-mentioned personal data processing. SIA has not ensured observation of the transparency
and accountability principle until now, because SIA is undergoing restructuring and these
activities were postponed due to shortage of resources, including measures for evaluation of
data processing. SIA does not ensure provision of information to the data subject, when
receiving data or delivering a parcel, considering the fact that the information on data obtained
and reasons of their processing are already known to the data subject and this information is not
used for other purposes. The personal data available to SIA are stored only electronically in
, Customer Relationship Management software, and in the Accounting programme. The
obtained data are stored in accordance with Article 6(1)(b) and (c) of the GDPR, namely, for the
performance of a contract and for compliance with the duty to provide evidence of a transaction
for accounting purposes. In addition, the duties defined in Section 41 of the Cabinet Regulation
No.585 “Regulations on Keeping and Organisation of Accounting” of 21 October 2003 and
Sections 2 and 7 of the Law “On Accounting” are carried out. SIA transfers the personal data it
possesses to outsourcing service providers, companies packing and delivering the ordered goods
for complete fulfilment of the agreement. The goods are packed by , while the
delivery is performed by (agreements enclosed), in
accordance with Article 6(1)(b) of GDPR. [..]
The annex contains Agreement No. on provision of services,
which has been concluded between SIA and , and, inter alia, provides that
(performer) in accordance with the Order Form puts the products together
and delivers them to final customers using courier services (Sub-Clause 1.3). The Agreement
stipulates matters related to confidentiality (Clause 5) and its content corresponds to the
agreement concluded between the controller and the processor.
The annex contains Agreement No on provision of logistic
services, which has been concluded between SIA and , Agreement No.
on sending and delivery of documents, parcels, packages, which has been concluded
between SIA and , Agreement No. on delivery of
correspondence, packages and cargo, which has been concluded between SIA and
, Agreement No. on provision of postal services, which has
been concluded between SIA and parcel delivery Agreement
No. , which has been concluded between SIA and
. (DSI 26.06.2019 reg. No.2-4.3/1030-S) (hereinafter—Explanation No.3).
4.9. The Official finds that the Case Files contain the DSI statement of 26.08.2019 with
annex No.2-5.1/213. It follows from the information included in the statement and the annex that
DSI officials visually inspected the website and this website contained
information about and an electronic order window for persons from Latvia. Persons
should specify their name and phone number when submitting an order. Clicking on the Privacy
Policy window at the bottom of the website, information on protection of personal data is
available. This information is identical to the one indicated in the Complaint, namely, the one
posted on . When clicking on the Report window at the bottom of the website,
it has been stated that the website contains a communication tool, where a text message can be
left (for example, feedback can be provided or a question can be asked indicating the person’s
name and/or surname, phone number and e-mail. The reference to
appears at the bottom of the website. (hereinafter—
Statement No.4)
4.10. The Official finds that the Case Files contain an administrative infringement
protocol No.FF000113 composed by the Official on 11.09.2019 (hereinafter—the Protocol),
Translation from Latvian
6
which states that “SIA in its business—retail sale via mail order or via Internet by
processing personal data of customers–natural persons (data subjects)3 (collection, recording,
storage, consulting, use, transfer, erasure)4 contrary to provisions of Articles 5(1)(1), 5(2) and
12(1) of the General Data Protection Regulation, has not provided the information provided in
Article 13 of the Regulation to data subjects, namely, has not ensured observation of the
transparency and accountability principle in the processing of personal data of natural persons
(customers).” The administrative infringement in the Protocol is qualified based on Article
83(5)(a) and (b) of the GDPR—for infringement of the basic principles for processing, including
conditions for consent, pursuant to Articles 5, 6, 7 and 9 of the GDPR and the rights of the data
subject pursuant to Articles 12 to 22 of the GDPR (Section 204.7(1) of the LAPC—Illegal
Operations with a Natural Person’s Data and Section 204.8 of the LAPC—Failure to Provide
Information to a Data Subject).
After the Protocol preparation, , representative of SIA
(hereinafter—the Representative), repeated the already submitted explanations No.1-3 of SIA
and testified to the questions asked by the Official that the nature of the infringement was clear
to her, that she recognised the infringement and regretted the committed infringement. In
addition, the Representative testified that on 06.09.2019 SIA stopped serving customers—natural
persons. At the same time, the Representative asked DSI to use the smallest amount of fine,
when applying the fine. (DSI 11.09.2019 reg. under No.2-2.3/12) (hereinafter—Explanation
No.4).
4.11. The Official finds that the Case Files contain reply letter of SIA of 07.10.2019 to
the DSI’s request on the data processing performed by SIA, where SIA explained that “[..] SIA
does not own the website , SIA is not a cooperation partner of the legal
person [..] . SIA always provides advertising agencies with advertising
samples for preparation of advertisements in accordance with the personal data protection
principles of SIA. Sample: .”
SIA explained that “[..] all answers to requests made by the DSI were prepared for SIA
by the Auditing Company, about which SIA informed the DSI. Having investigated the situation
independently, SIA came to the conclusion that the evidence regarding the fact that the website
specified by DSI has been created in the interests of SIA.” In its reply
letter SIA urged DSI to provide SIA with clarifying information or supporting documents that
has been prepared in the interests of SIA.
SIA explained that, “[..] taking into account that the website does not belong to SIA and
was not created at the instruction of SIA, trading to customers was not performed through this
website. was not traded through this website. SIA does not receive personal data of
natural persons. Contact information of natural persons comes from the call centre, contacts are
sent from the call centre in accordance with the goods to be ordered. SIA fulfils orders and sends
goods to the specified addresses. Personal data of customers, received through mediation of the
cooperation partner, were used only and solely for the purposes of performing the liabilities
under the concluded agreement and delivering orders to the customer. [..] Taking into account
the amount of information provided by the DSI to SIA, SIA draws the attention of DSI that for the
purposes of observing the GDPR, SIA was having an audit, which would allow to comply with
all GDPR requirements. Currently, SIA ensures protection of personal data to the extent
3
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an
identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier
such as a name, an identification number, location data, an online identifier or to one or more factors specific to the
physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 4(1) of the
Regulation);
4
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data,
whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment
or combination, restriction, erasure or destruction (Article 4(2) of the Regulation);
Translation from Latvian
7
provided for by the basis for collection, storage and transfer of personal data—Agreements
with cooperation partners and personal data protection policy. SIA needs time to conduct the
audit. The audit results have not been received yet. We inform that SIA stopped any advertising
at the beginning of September due to short-time financial difficulties. Until the audit opinion is
received (we assume that it will be received in the nearest time) and in case it reveals any
shortcomings, we will not resume its operations until they are completely rectified.” (DSI
09.10.2019 reg. under No.2-4.3/1671-S) (hereinafter—Explanation No.5).
4.12. The Official finds that the Case Files contain the DSI statement of 09.10.2019 with
annex No.2-5.1/248. It follows from the information included in the statement and the annex that
DSI officials checked websites and .
Using the Google search, the query of returned several websites with a
similar name, incl.
and several other.
When trying to enter , it was stated that at the time of visiting
access to the website was denied. By randomly entering websites
it was stated that they were similar both visually and in terms of use. The
information available on the websites provides evidence of distribution of . The visual
examination has revealed that the websites have an identical electronic order window. Persons
should specify their name and phone number when submitting an order. The reference to
appears at the bottom of the
websites.
When entering it has been stated that the website contains
information about and has an electronic order window for persons from Latvia.
Persons should specify their name and phone number when submitting an order. Clicking on the
Privacy Policy window at the bottom of the website, information on protection of personal data
is available in English.
Using whois.domaintools.com search for hosts of domains and
, it has been stated that when entering the domain in the
5
search, the search selects domain , which was registered on
from a server with an IP address , location
, while, when entering domain in the
6
search, the search selects domain , which was registered on
from a server with an IP address , location
. (hereinafter referred to as Statement No.5)
5. Regulatory enactment providing for responsibility for the administrative
infringement: Article 83(5)(a) and (b) of the GDPR provides that infringements of the following
provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000
000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of
the preceding financial year, whichever is higher: “a” the basic principles for processing,
including conditions for consent, pursuant to Articles 5, 6, 7 and 9 of the GDPR and the rights of
the data subject pursuant to Articles 12 to 22 of the GDPR (Section 204.7(1) and Section 204.8 of
the LAPC).
5.1. In accordance with Section 272 of the LAPC in examining an administrative
violation case, shall ascertain, whether the administrative violation has been committed, whether
the relevant person is guilty of committing it, whether this person may be subject to
administrative liability, whether material losses have been caused, as well as shall ascertain other
circumstances which are of importance in deciding the case correctly.
5
http://whois.domaintools.com/
6
http://whois.domaintools.com
Translation from Latvian
8
Therefore, in order to state whether SIA has committed any administrative
infringements under Articles 83(5)(a) and (b) of the GDPR (Section 204.7(1) and Section 204.8
of the LAPC), it is necessary to state that SIA processed personal data without observing
provisions of Articles 5, 6, 7, 9 and 12–22 of the GDPR.
5.2. Pursuant to Article 1(1) of the GDPR the purpose of the GDPR is to protect
fundamental rights and freedoms of natural persons and in particular their right to the protection
of personal data.
Pursuant to Article 2(1) of the GDPR, the GDPR applies to the processing of personal
data wholly or partly by automated means and to the processing other than by automated means
of personal data which form part of a filing system or are intended to form part of a filing
system. The processing of personal data by automated means includes data processing
information systems, where persons can be selected based on specific identifiers. A personal data
filing system means any structured set of personal data which are accessible according to
specific criteria, whether centralised, decentralised or dispersed on a functional or geographical
basis.
Pursuant to Article 4(1) of the GDPR ‘personal data’ means any information relating to
an identified or identifiable natural person (‘data subject’), while Article 4(2) of the GDPR
provides that ‘processing of personal data’ means any operation or set of operations which is
performed on personal data or on sets of personal data, whether or not by automated means, such
as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, restriction, erasure or destruction.
Thus, person’s name, surname, phone number, e-mail and residence or declared address
and other information identifying the specific person is considered personal data, while
collection, storage, use and transfer of these personal data shall mean processing of personal data
within the meaning of Article 4(2) of the GDPR.
Pursuant to Section 4(7) of the GDPR the controller, the natural or legal person, public
authority, agency or other body which, alone or jointly with others, determines the purposes and
means of the processing of personal data is responsible for compliance of the processing of
personal data. In this particular case, SIA is the controller.
Pursuant to Article 6(1) of the GDPR processing shall be lawful only if and to the extent
that at least one of the bases referred to in Article 6(1) applies. The GDPR defines six general
legal basses: consent, performance of a contract, legal obligation, public interests, protection of
vital interests and pursuing of legitimate interests. In addition to the provision of a legal basis,
Article 5 of the GDPR should be observed when processing personal data, pursuant to which to
protection interests of the person (data subject), the controller shall ensure fair and lawful
processing of personal data, as well as processing of personal data only in accordance with the
intended purpose and in the necessary scope.
Moreover, observing the accountability principle defined in Article 5(2) of the GDPR, it
is the controller who is responsible for the process of processing of such personal data, which
can prove that the processing of personal data complies with the requirements of the data
protection regulation.
Recital 39 of the GDPR explains that “Any processing of personal data should be lawful
and fair. It should be transparent to natural persons that personal data concerning them are
collected, used, consulted or otherwise processed and to what extent the personal data are or
will be processed. The principle of transparency requires that any information and
communication relating to the processing of those personal data be easily accessible and easy to
understand, and that clear and plain language be used. That principle concerns, in particular,
information to the data subjects on the identity of the controller and the purposes of the
processing and further information to ensure fair and transparent processing in respect of the
natural persons concerned and their right to obtain confirmation and communication of
Translation from Latvian
9
personal data concerning them which are being processed. Natural persons should be made
aware of risks, rules, safeguards and rights in relation to the processing of personal data and
how to exercise their rights in relation to such processing. In particular, the specific purposes
for which personal data are processed should be explicit and legitimate and determined at the
time of the collection of the personal data. The personal data should be adequate, relevant and
limited to what is necessary for the purposes for which they are processed. This requires, in
particular, ensuring that the period for which the personal data are stored is limited to a strict
minimum. Personal data should be processed only if the purpose of the processing could not
reasonably be fulfilled by other means. In order to ensure that the personal data are not kept
longer than necessary, time limits should be established by the controller for erasure or for a
periodic review. Every reasonable step should be taken to ensure that personal data which are
inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures
appropriate security and confidentiality of the personal data, including for preventing
unauthorised access to or use of personal data and the equipment used for the processing.”
Furthermore, recital 58 of the GDPR explains that “the principle of transparency
requires that any information addressed to the public or to the data subject be concise, easily
accessible and easy to understand, and that clear and plain language and, additionally, where
appropriate, visualisation be used. Such information could be provided in electronic form, for
example, when addressed to the public, through a website. This is of particular relevance in
situations where the proliferation of actors and the technological complexity of practice make it
difficult for the data subject to know and understand whether, by whom and for what purpose
personal data relating to him or her are being collected, such as in the case of online
advertising.” Also the Working Party on the Protection of Individuals with Regard to the
Processing of Personal Data7. In the transparency guidelines in accordance with clear
implementation of the transparency principle under the GDPR.
The transparency principle also includes the right of the data subject to be informed and
Article 12 of the GDPR provides that the controller shall take appropriate measures to provide
any information referred to in Articles 13 and 14 [..] in a concise, transparent, intelligible and
easily accessible form, using clear and plain language, which means that the controller shall be
liable to provide the data subject with the possibility to supervise the processing of data.
Article 12(1) of the GDPR respectively provides that transparent information is
information, which is concise, transparent, intelligible. The guidelines provide that the “Easy
availability” element means that the data subject should not be forced to search for information;
they should see immediately, where and how they can access this information, for example, by
providing it to them directly, providing a link to it, clearly indicating it as an answer to a
question in a natural language, for example, a notice on data protection of several levels, in
section “Frequently asked questions”, which provide that one of the most effective techniques of
the implementation of the transparency principle (which provides the data subject with
information on the processing of their data) is publishing on the website of the institution.
Therefore, processing of personal data is recognised to be legal, only if one of the bases
and principles specified in these articles exist.
In addition, the Official finds that the controller should also ensure the fulfilment of the
requirements of the GDPR, including observation of the rights of the data subject defined in
Chapter III of the GDPR.
Recital 63 of the GDPR explains that ‘A data subject should have the right of access to
personal data which have been collected concerning him or her, and to exercise that right easily
and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing.
[…] Every data subject should therefore have the right to know and obtain communication in
7
Created based on Article 29 of Directive 95/46/EC of the European Parliament and of the Council of 24 October
1995 on the protection of individuals with regard to the processing of personal data and on the free movement of
such data.
Translation from Latvian
10
particular with regard to the purposes for which the personal data are processed, where
possible the period for which the personal data are processed, the recipients of the personal
data, the logic involved in any automatic personal data processing and, at least when based on
profiling, the consequences of such processing.’
Articles 13–15 of the GDPR list the rights of the data subject, namely, the data subject
shall be entitled to receive the information defined in these articles relating to the processing of
the personal data of the data subject. For example, Article 13 of the GDPR defines the right to
receive information the controller should provide, if the personal data are obtained from the data
subject (for example, to learn the purpose and the legal basis (indicating specific clause of
Article 6(1) of the GDPR) of processing of the personal data, or for how long and where the data
are stored, whether they are transferred to third parties, etc.), while Article 14 of the GDPR
provides, which information the controller should provide to the data subject, if personal data
were not obtained from the data subject.
Article 24 of the GDPR defines liability of the controller. In accordance with Article
24(1) of the GDPR, taking into account the nature, scope, context and purposes of data
processing as well as the risks of varying likelihood and severity for the rights and freedoms of
natural persons, the controller shall implement appropriate technical and organisational measures
to ensure and to be able to demonstrate that processing is performed in accordance with the
GDPR. Therefore, the controller (the Company) should take relevant technical and
organisational measures to protect personal data and prevent their potential illegal processing.
Therefore, in each particular case the controller should evaluate the need for, the legal
basis, the purpose of processing of the personal data, types and scopes of the personal data being
processed, the potential number of persons, whose personal data are planned to be processes, as
well as technical and organisational measures, which secure processing of the personal data, etc.
5.3. The official, based on the conditions of Agreement No.
appended to Explanation No.3, concludes that personal data (name, phone No.) are obtained
using advertising and information modules, which is static (with a static image) or animated,
graphic information block and/or information block containing text of any form and layout, and
has been placed on the website, the selection of which is in competence of SIA, and after
ordering , in accordance with provisions of Agreement No. and
Agreement No. , additional data (for example, ordering customer’s
surname, address, e-mail) are obtained by phone.
At the same time, the Official, based on the information provided in Explanation No.2
and conditions of Agreement No. and Agreement No
provided in Explanation No.3 and annex thereto, concludes that the controller of the
above-mentioned processing of personal data is SIA, because, when selling goods, the operator
should use proper conversation scenarios issued by SIA (each conversation scenario is
considered an annex and an integral part of the two above-mentioned agreements) and
information, which is received by the operator as part of provision of services, is considered
confidential and property of SIA, as well as the content of the agreements concluded by SIA
corresponds to the agreement concluded between the controller and the processor (includes
individual elements defined in Article 28(3) of the GDPR).
This certifies that , the product produced at the commission of SIA, which is
sold by SIA, can be ordered at any website selected by SIA, where the advertising and
information module created by the cooperation partner will be placed at the instruction of SIA.
Taking into account the aforementioned, the Official concludes that in a situation, when
can be ordered on the websites specified the information in Statement No.2, No.3,
No.4 and No.5 providing a reference to
using an identical advertising and information module, moreover, one of the
websites ( , created on ) has a Privacy Policy of SIA, which does
not meet the requirements of the GDPR, which is confirmed by annex to Statement No.5, and the
Translation from Latvian
11
controller for the processing of personal data is SIA. It is essential that the websites specified
in the Complaint, Statement No.2, No.3 and No.4 have an identical Privacy Policy, where no
information about the controller is provided and which does not meet the requirements of the
GDPR, as well as the fact that the Invoice appended to the Complaint about ordered on
specified in the Complaint states the address of SIA. It should be taken into
account that as specified by SIA in Explanation No.2, the website , which
provides a reference to , is an
advertising web page about the product of SIA developed on the instruction of SIA based on a
contract.
Visual similarities and usage similarities of and
should also be noted, as well as the fact that domains of websites and
have been registered from one and the same server with IP address
, the location of which is
and the fact that was registered on (before
the Case was started and was liquidated during its investigation), but website
was registered on (during investigation of the Case) and, when providing
Explanations No.3 and 4 unambiguously confirmed that SIA is related to ,
which confirms that SIA organised retail trade of through .
Having summarised and evaluated all the aforementioned, the Official has concluded that
SIA is a controller for the processing of personal data on:
and , on other websites [..] specified
in Statement No.5 and in the annex.
The Official also concludes that the information included in Explanations No.1–3
evidences that SIA, as a controller, before the audit of compliance of the processing of personal
data with GDPR did not perform the assessment of the personal data processing with the GDPR,
therefore the GDPR requirements were not observed in the processing of personal data,
including observations of the transparency and accountability principle was not ensured.
The Official critically evaluates the information provided by SIA in Annex No.5, which,
in essence, contains contradictory information in SIA’s Explanations No.1–4, including the
cooperation agreements concluded by SIA, and with regard to the person providing explanation
to the DSI, even provides false information (explanations are provided by the member of the
board of SIA), therefore she recognises the arguments provided in Explanation No.5 of SIA as an
attempt of SIA to avoid responsibility for the failure to perform duties investigated in the Case. It
should also be taken into account that the Invoice appended to the Complaint states the address
of SIA, indicating inappropriate name of the undertaking ( rather than SIA).
Explanation No.5 does not contain an indication that does not belong to
SIA (was created in the interests of SIA), but indicates to probably missing evidences, which
would be confirmed by the fact that access to this internet website was denied during
investigation.
In addition, the Official indicates that the fact that does not belong
to SIA (was created in the interests of SIA), is not decisive to state the role of SIA in processing
of the data. Namely, in several judgements the European Court of Justice recognised that a
natural or legal person who exerts influence over the processing of personal data, for his own
purposes, and who participates, as a result, in the determination of the purposes and means of
that processing, may be regarded as a controller [within the meaning of Article 2(d) of Directive
95/46]8 (judgement, 10 July 2018, Jehovan todistajat, C‑25/17, EU:C:2018:551, Paragraph 68). It
can be stated from the evidences available in the Case that the purpose of SIA were retail sales
of to gain profit, which was performed by determining and using a tool—
, es.therecardio.com, etc.
8
In accordance with Article 94 of the GDPR the Directive 95/46/EC is repealed with effect from 25 May 2018.
References to the repealed Directive shall be construed as references to the GDPR.
Translation from Latvian
12
In light of the foregoing, having checked case files, having evaluated
circumstances of the Case and the evidences available in the Case jointly with the arguments
provided by SIA, the Official states that SIA performed retail sales of through websites
, and other websites, was a controller
for the processing of personal data of customers–natural persons (data subjects) (collection,
recording, storage, consulting, use, transfer, erasure), without observing provisions of Article
5(1)(a), 2 and 12(1) of the GDPR, namely, has not provide the data subject with information
provided in Article 13 of the GDPR thus not ensuring observation of the transparency and
accountability principle in the processing of personal data of natural persons (customers).
In light of the foregoing, the Official finds that SIA has committed administrative
infringements, which are subject to responsibility under Article 83(5)(a) and (b) of the GDPR
(Section 204.7 and Section 204.8 of the LAPC).
5.4. The Official finds that the guilt of SIA in commitment of the administrative
infringements under Articles 83(5)(a) and (b) of the GDPR (Section 204.7(1) and Section 204.8
of the LAPC) is proved by: 1. Complaint by ; 2. Explanations No.1–5 of SIA, 3.
Protocol, 4. DSI Statements No.1–5.
6. Decision of the institution (official), which examined the administrative
infringement case:
6.1. In accordance with Article 83(2) of the GDPR, when deciding whether to impose an
administrative fine and deciding on the amount of the administrative fine in each individual case
due regard shall be given to the following: a) the nature, gravity and duration of the infringement
taking into account the nature scope or purpose of the processing concerned as well as the
number of data subjects affected and the level of damage suffered by them; b) the intentional or
negligent character of the infringement; c) any action taken by the controller or processor to
mitigate the damage suffered by data subjects; d) the degree of responsibility of the controller or
processor taking into account technical and organisational measures implemented by them
pursuant to Articles 25 and 32; e) any relevant previous infringements by the controller or
processor; f) the degree of cooperation with the supervisory authority, in order to remedy the
infringement and mitigate the possible adverse effects of the infringement; g) the categories of
personal data affected by the infringement; h) the manner in which the infringement became
known to the supervisory authority, in particular whether, and if so to what extent, the controller
or processor notified the infringement; i) where measures referred to in Article 58(2) have
previously been ordered against the controller or processor concerned with regard to the same
subject-matter, compliance with those measures; j) adherence to approved codes of conduct
pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and k) any
other aggravating or mitigating factor applicable to the circumstances of the case, such as
financial benefits gained, or losses avoided, directly or indirectly, from the infringement.
Recital 148 of the preamble to the GDPR explains that ‘in order to strengthen the
enforcement of the rules of this Regulation, penalties including administrative fines should be
imposed for any infringement of this Regulation, in addition to, or instead of appropriate
measures imposed by the supervisory authority pursuant to this Regulation. In a case of a minor
infringement or if the fine likely to be imposed would constitute a disproportionate burden to a
natural person, a reprimand may be issued instead of a fine. Due regard should however be
given to the nature, gravity and duration of the infringement, the intentional character of the
infringement, actions taken to mitigate the damage suffered, degree of responsibility or any
relevant previous infringements, the manner in which the infringement became known to the
supervisory authority, compliance with measures ordered against the controller or processor,
adherence to a code of conduct and any other aggravating or mitigating factor. The imposition
of penalties including administrative fines should be subject to appropriate procedural
safeguards in accordance with the general principles of Union law and the Charter, including
effective judicial protection and due process.’
Translation from Latvian
13
Pursuant to Section 22 of the LAPC, administrative sanction is the means of liability
and shall be applied in order to educate a person, who has committed an administrative violation,
in the spirit of law abiding and respecting provisions of social life, as well as in order to prevent
the violator of the rights, as well as other persons, from committing new violations.
Pursuant to Section 32 of the LAPC, in imposing a sanction the nature of the committed
violation, the personality of a violator, the degree of his or her culpability, the liability mitigating
and aggravating circumstances shall be taken into account.
Pursuant to Section 35 of the LAPC, if one person has committed two or more
administrative violations, an administrative sanction shall be imposed for each violation
separately. If a person has committed administrative violations, which have been determined
simultaneously, and they are examined by one and the same institution (official), administrative
sanction shall be imposed within the framework of that sanction which is provided for the more
serious violation. In such a case a basic sanction may be supplemented by any of the additional
sanctions, which are provided for in the Sections, which determine liability for any of the
violations committed.
6.2. When determining the sanction, the Official takes into account the following
aspects of the infringement: 1) the nature, gravity and duration—in this particular case, SIA, by
performing retail sales of through several websites, processed personal data of
customers–natural persons (data subjects)—collection, recording, storage, consulting, use,
transfer, erasure) without observing provisions of Article 5(1)(a), 2 and 12(1) of the GDPR,
namely, has not provided the data subject with information provided in Article 13 of the GDPR,
thereby not ensuring observation of the transparency and accountability principle in the
processing of personal data of natural persons (customers) at least since 10.07.2018 (the date,
when the purchase of by was registered) and until 06.09.2019 (the date,
when according to the information provided by the representative of SIA in Explanation No.4
SIA stopped serving customers–natural persons); 2) the intentional or negligent character of the
infringement—in this particular case the processing of the personal data by SIA without
providing data subjects with the information defined in the GDPR, shall be considered
intentional; 3) the number of data subjects affected—in the Case the Official has not managed to
learn the specific number of the data subjects affected. In this particular case, the Official, taking
into account that was distributed through several websites, incl.
and other websites that are oriented to consumers–
natural persons in several European Union Member States, and in accordance with the available
information SIA has been registered since 26.05.2015 and financial indicators for the last
submitted year 2017 show the turnover of SIA in the amount of EUR 12,470,064.00, the Official
has come to the conclusion that the number of affected data subjects was considerable. 3)
Previous infringements by the controller—in this particular case, SIA was not previously
administratively punished for committing the infringement examined in this decision; 5) The
degree of cooperation of the company with the supervisory authority—at first, SIA cooperated
with the institution, but in Explanations No.5 provided information contradictory to that
provided in SIA’s Explanations No.1–4 and has not provided the supervisory authority with
information, since when (specifying the exact date) SIA has been selling to customers–
natural persons using the website customers–natural persons, of which
countries (specifying each) were sold by SIA and specify the exact number of
customers–natural persons, who ordered from SIA and whom SIA has sold and
delivered since SIA has started to distribute , using 7) the
manner in which the infringement became known to DSI—complaint of a data subject
transferred to DSI by other supervisory authority; 8) any other aggravating or mitigating factor
applicable to the circumstances of the case— the Official finds that financial benefits have been
gained from the infringement indirectly.
Translation from Latvian
14
Taking into account the aforementioned and the purpose of the administrative sanction,
the Official concludes that the fine provided for within the scope of the sanction for infringement
under Article 83(5)(1) of the GDPR (Section 204.7(1) of the LAPC) and Article 83(5)(b) of the
GDPR (Section (204.8) amounting to 1% of the net turnover of 2017 (EUR 12,470,064) at the
end of the period (last available data) should be imposed on SIA.
In light of the foregoing, based on Article 83(2) of the GDPR, Sections 236. 10, 275(1)(1),
276(1) and (2), 279(1), 281 of the LAPC, the Official
decides:
1. To impose on Limited Liability Company , registration
number , an administrative fine of EUR 124,700.64 (one hundred and twenty-four
thousand seven hundred euro 64 cents) for the committed infringement, which is subject to
responsibility under Article 83(5)(a) of the GDPR (Section 204.7 (1) of the LAPC).
2. To impose on Limited Liability Company , registration
number , an administrative fine of EUR 124,700.64 (one hundred and twenty-four
thousand seven hundred euro 64 cents) for the committed infringement, which is subject to
responsibility under Article 83(5)(b) of the GDPR (Section 204.8 of the LAPC).
3. Based on Article 35(2) of the Latvian Administrative Procedure Code, to impose
on Limited Liability Company , registration number , the final
fine of EUR 150,000 (one hundred and fifty thousand euro and 00 cents).
The decision can be appealed by submitting a complaint to the DSI director at Blaumaņa
iela 11/13-15, Riga, LV-1011, within 10 (ten) working days of the day of notification of
(receiving) the decision.
The fine can be paid in any bank institution. Details for payment of the fine:
Beneficiary: State Treasury
Registration No.: 90000050138
Account No.: LV69TREL1060191019200
Beneficiary’s BIC code: TRELLV22
Notes: Specify the date and number of this decision.
8. Signature
Data State Inspectorate
Personal Data Processing
Supervision Department Head