Berlin Commissioner for
631.221.4 Data Protection and
Freedom of Information
521.11551
IMI (56) 126901 Friedrichstr. 219
10969 Berlin
IMI CR 134719
Visitors’ entrance:
IMI DD 137776 Puttkamer Str. 16-18
IMI FD 159432
The building is fully accessible to
disabled members of the public.
Callosum Software GmbH
Contact us
Mr [redacted]
Wallstr. 88 Phone: +49 (0)30 13889-0
Fax: +49 (0)30 215 50 50
10179 Berlin
Use our encrypted contact form
for registering data protection
Berlin, 22 October 2020 complaints:
www.datenschutz-berlin.de/be-
schwerde.html
Reprimand
For all other enquiries, please
Your letters of 17 September 2019, 21 October 2019 and 27 November send an e-mail to:
2019 [email protected]
Fingerprint of our
Dear Mr. [redacted], PGP-Key:
D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
We hereby issue a reprimand to your company for a violation of the
General Data Protection Regulation (GDPR) when processing per-
sonal data in your area of responsibility. Office hours
Daily from 10 am to 3 pm,
Justification: Thursdays from 10 am to 6 pm
(or by appointment)
Our decision is based on the following considerations:
How to find us
I. The underground line U6 to
Kochstraße / Bus number M29
We have established the following facts: and 248
The complainant has an account with you under the link Visit our Website
tellonym.me/[redacted]. In a letter dated 11 April 2019, the complainant's
https://privacy.de
mother, who is entitled to represent the complainant, requested that you
provide her with a copy of the personal data that you have stored about the
complainant. Initially, you refused to do so, citing reasons of data protection
law. You did not respond to further requests by the complainant's author-
ised representatives.
You first stated that at the time of the request you had no valid indications
that the sender was in fact the mother of the complainant. In particular, you
did not know the first or last name of the account user [redacted], the e-mail
was not sent from an e-mail address that is linked to the account concerned
and you regularly receive so-called "phishing" requests in which third par-
ties attempt to obtain private data. For this reason, you did not answer the
inquiry. The request from the legitimate mother of the complainant was
wrongly identified as a request for data on inappropriate content, which led
to the suggestion to contact a local police station. The complainant's
-2-
mother, who was entitled to represent her, had not made any further in-
quiry, so that you regarded the matter resolved.
In your comments of 17 September 2019 and 21 October 2019, you first in-
formed us of the categories of data that you had stored on the complainant.
We then drew your attention to your legal obligation under Article 15(1),
second half-sentence (GDPR) according to which data subjects have a
right of access to this personal data, not only to the categories of data,
when data is processed.
In a letter dated 27 November 2019, you provided us with the specific data
relating to the account [redacted] and sent us a letter to the mother of the
complainant who is entitled to represent her, announcing that the data ex-
port would be sent by e-mail.
II.
The reprimand is based on Art. 58(2) (b) GDPR. There has been a violation
of the GDPR in your area of responsibility.
Under Article 12(3) sentence 1 of the General Data Protection Regulation
(GDPR), the controller must provide the data subject with information on
the measures taken in response to an application under Articles 15 to 22
GDPR without delay, as a rule, and in any event within one month of re-
ceipt of the application. This means that the controller must provide the in-
formation or at least state why this is not possible within the deadline. This
time limit may exceptionally be extended by a further two months if this is
necessary in view of the complexity and number of applications. However,
the GDPR does not provide for a routine and blanket extension of the dead-
line without examining the individual case. Nor have you informed the com-
plainant's mother, who is authorised to represent her, of an extension of the
deadline and the reasons for it.
In the present case, you state that you have not provided information within
the meaning of Article 15(1) or (3) of the GDPR, in particular because of
doubts as to the identity of the complainant or the complainant's mother en-
titled to represent her.
However, according to Article 12(6) of the GDPR, the controller may, if
there is reasonable doubt as to the identity of the natural person, request
additional information necessary to confirm the identity of the person con-
cerned.
A request for additional information to identify the complainant or the com-
plainant's mother entitled to represent her has not been made. Rather, the
request was not correctly identified and you have sent a reply from the fre-
quently asked questions templates. Callosum Software GmbH has there-
fore responded inappropriately to the request for access.
Consequently, the reply to the request for access of 11 April 2019 was sent
significantly late on 27 November 2019. This constitutes a violation of Art.
12(3) GDPR.
Taking into account the specific circumstances of the facts of the case, we
consider a reprimand to be appropriate after completion of our investiga-
tion. This is the first time we have established a violation on your part. In re-
sponse to our inquiry, you showed understanding and announced that you
-3-
would comply with data protection regulations and remedy the conduct for
which you have been reprimanded.
In the safe expectation that you will comply with the data protection regula-
tions in the future, we consider the matter closed.