631.262.3
521.11594
Berlin Commissioner for
CR 46746 Data Protection and
DD 149278 Freedom of Information
Friedrichstr. 219
10969 Berlin
27 October 2020 Visitors’ entrance:
Puttkamer Str. 16-18
Final Decision The building is fully accessible to
disabled members of the public.
Just Fabulous GmbH
Executive Board Contact us
Schlesische Straße 38 Phone: +49 (0)30 13889-0
10997 Berlin Fax: +49 (0)30 215 50 50
Use our encrypted contact form
for registering data protection
complaints:
Reprimand www.datenschutz-berlin.de/be-
schwerde.html
Complainant: [redacted]
Your letters of 30 September 2019, 22 November 2019, 30 December For all other enquiries, please
send an e-mail to:
2019, and 3 February 2020 [email protected]
Fingerprint of our
PGP-Key:
The Berlin Commissioner for Data Protection and Freedom of Information D3C9 AEEA B403 7F96 7EF6
issues a reprimand to the Just Fabulous GmbH for a violation of the Gen- C77F B607 1D0F B27C 29A7
eral Data Protection Regulation (GDPR) when processing personal data in
their area of responsibility. Office hours
Daily from 10 am to 3 pm,
Reasoning: Thursdays from 10 am to 6 pm
(or by appointment)
The decision by the Berlin DPA is based on the following considerations:
How to find us
I. The underground line U6 to
The Berlin DPA has established the following facts: Kochstraße / Bus number M29
and 248
On 13 June 2019, the above mentioned complainant revoked her consent
Visit our Website
to the recording of telephone conversations by the Just Fabulous GmbH
and requested a list of the data stored about her, more precisely the stored https://privacy.de
telephone conversations.
By way of email of 14 June 2019 the complainant was informed that the
transmission is not possible for data protection reasons.
The controller stated the following in their statements:
The employee in charge had assumed that the complainant wanted to ex-
press in her e-mail that she wished to receive a copy of the respective tele-
phone records. The complainant had not clarified that it was a request for
information as to which telephone calls had been recorded.
After the complainant had revoked her consent to the data processing of
telephone calls on 13 June 2019, Just Fabulous GmbH immediately com-
-2-
plied with her request. As the revocation was valid for the future, telephone
calls made prior to the revocation were not affected by her revocation of her
consent to telephone recording. However, due to the short erasure period
of 28 days, the telephone calls had already been erased when the Berlin
data protection authority intervened with the first request for a statement on
3 September 2019 and the response of Just Fabulous GmbH on 30 Sep-
tember 2019.
Due to a misunderstanding, the employee in charge had assumed that the
complainant was requesting the actual recordings, i.e. a transmission of the
telephone calls made instead of a list of the telephone calls. Once this
problem had been resolved, the automatic erasure period for the telephone
call recordings had already expired. Moreover, most of the recordings had
al-ready been erased at the time of their request. Which telephone calls
were still present as audio at the time of the complainant’s revocation of
their consent, could not be identified by the Just Fabulous GmbH because
of the previous erasure.
The controller also informed the Berlin DPA that a customer service em-
ployee could not interrupt or erase a recording once started. However, a
manual erasure before the end of the automatic erasure period of 28 days
would be possible.
Furthermore, the controller stated that it was not possible to identify a spe-
cific caller in the telephone system used, unless the telephone number was
known. However, there is an exception to this rule if the customer calls with
the telephone number stored in the customer account. If this is the case,
the telephone number is assigned to the corresponding customer account
by means of a so-called contact hash, which would enable the creation of
an overview of the recorded telephone conversations with the customer
over this telephone number.
When the Berlin DPA intervened, it was not possible to create an overview
of the recorded conversations with the complainant because the relevant
audio files no longer existed due to the erasure period.
In addition, the creation of an overview of caller data from the ACD system
(automatic call distribution) in text form was no longer possible, as these
were no longer available after 90 days. The Berlin DPA was informed of
this in a statement dated 22 November 2019.
In addition, when interacting with customer service by phone, notes on the
conversation would be created in the respective customer file in the cus-
tomer management system. The complainant had been informed about this
data processing in the context of a statement provided.
Information on the data stored on the complainant in accordance with Arti-
cle 15 of the GDPR had been provided to the complainant on 1 October
2019. An explanation was also provided on 4 October 2019.
II.
The reprimand is based on Article 58(2)(b) GDPR. There has been a viola-
tion of the GDPR in the controller’s area of responsibility.
Pursuant to Article 15(1) and (2) GDPR, the data subject has a comprehen-
sive right to access their personal data that has been processed as well as
to further information.
-3-
In an e-mail dated 13 June 2019, the complainant requested a list of tele-
phone calls. However, the customer service department informed her that
the records could not be sent to her due to data protection reasons.
The complainant's request of 13 June 2019 must be interpreted in such a
way that she did not want to receive the telephone records herself, but
wanted to obtain erasure of the telephone records and a listing of the tele-
phone calls. In doing so, the complainant sufficiently specified her request
for information.
At that time, despite the short erasure period, the telephone call of 13 June
2019 and any other recordings were available.
It is true that Article 17(1)(b) GDPR stipulates that personal data must be
erased if the consent to data processing was revoked and no other legal
basis justifies continued storage. No legal basis for the recording of tele-
phone conversations other than consent is apparent here.
If, however, a request for access is received at the same time as the revo-
cation and the associated obligation to delete the data, this must be pro-
cessed with priority in order to guarantee the rights of the data subjects.
Even if, as the controller has pointed out, assignment to a customer could
be problematic under certain circumstances, the employee responsible
should have recognized the request made by the complainant to Customer
Service as a specific request for access and should have been able to re-
quest further information for identification purposes (e.g. naming the rele-
vant telephone numbers).
However, the employee's incorrect assessment of the complainant's re-
quest was not followed up and the complainant's request for access was
overtaken by the automatic erasure of the data.
Since the controller is no longer able to comply with the request for access
due to the erasure deadlines, the controller has made it impossible to pro-
vide concrete information in relation to the telephone records in accordance
with Article 15(1) and (2) GDPR by deleting the data and thus to enforce
the rights concerned.
Taking into account the specific circumstances of the facts of the case, the
Berlin DPA considers a reprimand to be appropriate after completion of our
investigation. This is the first time the Berlin DPA has discovered a violation
on this controller’s part in this matter. In response to the Berlin DPA’s ad-
dress on the matter, the controller showed understanding and announced
that they would comply with data protection regulations and remedy the
conduct.
The Berlin DPA expressly points out that after a revocation of consent, not
only must future recordings be omitted, but existing recordings must also
be erased. Since a revocation can also be declared during an ongoing con-
versation, the controller must take suitable technical and organizational
measures in accordance with Article 24(1) GDPR so that the respective
employee can immediately terminate an ongoing recording of a conversa-
tion. The controller should also note that they should organize their data
processing in such a way that they can immediately fulfil their obligations to
-4-
provide information in accordance with Article 15 GDPR, and in particular
that they can research all calls and recordings at short notice.
In the safe expectation that the controller will comply with data protection
regulations in the future, the Berlin DPA closes the case after issuing the
reprimand.