FOR DATA PRIVACY AND FREEDOM OF INFORMATION
Your: 07.05.2020
Management board member
Our. 14.08.2020 nr 2.1.-1/19/4601
Notice of termination of the proceeding in regard to the protection of personal data
The proceeding of the Estonian Data Protection Inspectorate concerned the claim of a Lithuania
citizen (complainant) in regard to the fact that the
transferred the personal data of the complainant about his dept to , without
informing about debt.
Given the above, we initiated a supervision proceeding on the basis of clause 56 (3) 8) of the
Personal Data Protection Act.
In its response to the inquiry from the Estonian Data Protection Inspectorate,
stated that it did not violate the Personal Data Protection Act or the General Data
Protection Regulation, but acted in accordance with the laws and the contract concluded with
the client.
During the proceeding, stated the following:
1. The complainant was a client of , who ordered the service of
by concluding a service provision contract with on
06 January 2007. On 18 August 2009, terminated the contract with
the complainant due to a debt. processes the appellant’s personal
data (name, surname, address, telephone number, and personal identification code)
based on the concluded contract and law in order to perform the contract and recover
the debt.
2. On 16 September 2019, forwarded the complainant’s personal data
to in accordance with the contract concluded with the .
3. Clause 11.3 of the contract concluded with the client highlights that
has the right to transfer, without the consent of the client, its contractual rights and
obligations to third parties, provided that the transfer does not violate the client’s rights.
The client’s rights have not been violated, as upon conclusion of the contract, it was
agreed that the client will receive the service and will be paid for
the service provision. If the debt for the service remains unpaid, the service provider
has the right to demand the payment of debt that the client had to take into account
when concluding the contract. The same option is also provided in subsection 164 (1)
the Law of Obligations Act, establishing that an obligee may transfer the claim thereof
to another person on the basis of a contract in part or in full regardless of the consent
of the obligor (assignment of claim). A claim shall not be assigned if assignment is
prohibited by law or if the obligation cannot be performed for the benefit of any other
person but the original obligee without altering the content of the obligation. The client
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
failed to pay the debt, after which transferred the debt to a person
processing debts, and in this case, to for debt recovery purposes.
4. offers credit management services. As entered into an
agreement with , then the new creditor and the data controller is
.
5. s had the right to transfer the personal data to in
accordance with the agreement with the client and law (in point 3). On 23 October
2019, informed the complainant that had transferred
the complaint´s personal data to , therefore the new creditor and the data
controller is .
has explained to the Estonian Data Protection Inspectorate that it received
the complainant’s data in connection with the conclusion of a contract with him for the use of
the service and shall process such data to perform the contract – for debt recovery purposes.
As the complainant failed to pay the debt, his details were transfered to the with
whom had a debt collection contract.
Information that may transfer the complaint’s data to third parties without
his consent has already been communicated to the complainant upon conclusion of the contract
(clause 11.3 of the contract). It is clear from the response of that the
complainant was notified by on the transfer of the debt on 23 October 2019.
The Estonian Data Protection Inspectorate also explains that with regard to processing of
personal data, it only assesses whether the transfer of personal data has been lawful, not the
lawfulness of the debt claim. The Estonian Data Protection Inspectorate does not have the
competence to assess whether the debts of individuals against the creditor have arisen lawfully,
what the claims consist of, whether or not the debt has actually been liquidated, whether or not
the rules for the assignment of the claim have been complied with, as those are disputes that
arise from contractual relations. Settlement of contractual disputes between private parties is a
matter for the civil court.
As has received personal data from the complainant at the time of
concluding the contract and processes such data lawfully (for the purpose
of concluding and performing the contract) and the complainant has been informed of the
transfer of personal data or the possibility thereof, we find that the processing of the
complainant’s personal data was lawful. Therefore, we shall terminate the supervisory
proceeding.
Respectfully
/signed digitally/
Senior Inspector
authorised by Director General