FOR DATA PRIVACY AND FREEDOM OF INFORMATION
Your: 01.10.2020
Management board member
Our: 09.11.2020 no 2.1.-1/20/3119
Reprimand and notice of termination of the proceedings concerning the protection of
personal data
Estonian Data Protection Inspectorate (inspectorate) received a complaint from a Finnish
citizen via the Internal Market Information system IMI, concerning the disclosure of the debt
information of natural persons on the webpage of :
. In connection with that, the inspectorate
initiated a supervision proceeding on the basis of clause 56 (3) 8) of the Personal Data
Protection Act.
During the proceeding the inspectorate established that in addition to the aforementioned web
link, the information of debtors has been disclosed also on the web link:
.
In connection with that, the inspectorate made a proposal to in the matter of
personal data protection no. 2.1.-1/20/3119 on 11 September 2019 which reads as follows:
“Remove the personal data (name, debt) relating to the violation of an obligation, disclosed on
the webpage of ”. The deadline for responding to the proposal was 23
September 2020. Within the proposal, the inspectorate also draw attention to the possibility of
a precept and imposing of a penalty payment.
As the proposal of the inspectorate was not replied within the prescribed time, the inspectorate
issued a precept-warning to on 30 September 2020, which reads as follows:
“Discontinue the disclosure of personal data (name, debt) relating to the violation of an
obligation on the webpage . The disclosed personal data can be found on
the following web links: and
.”.
On 1 October 2020, a representative of sent a response to the inspectorate,
according to which the personal data relating to the violation of an obligation have been
removed from the webpage. After receipt of the confirmation, the inspectorate also inspected
the webpage and did not establish any personal data in connection to the
violation of an obligation.
-
Based on the materials of the case, disclosed on its webpage
the names and amounts of debt of persons, that is, it processed personal
data.
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
However, when processing personal data, one must follow the requirements of the Personal
Data Protection Act and the General Data Protection Regulation (GDPR), incl. it follows from
Article 6 of the GDPR that processing of personal data is lawful only if carried out on the basis
of one of the grounds listed in Article 6 of the GDPR. The burden of proof in that regard lies
with the controller.
Regardless of the legal grounds, a controller must follow also the principles set out in Article 5
of the GDPR, incl. the provisions of paragraph 1 idents a, b and c:
- processing is lawful, fair and transparent for the person;
- purpose limitation – personal data are collected for specified, explicit and legitimate
purposes;
- data minimisation – personal data are adequate, relevant and limited to what is necessary
in relation to the purposes for which they are processed.
The controller shall be responsible for, and be able to demonstrate compliance with these
obligations (see GDPR, Article 5, paragraph 2). At the same time, we explain that personal data
may be processed only within the extent that is necessary for the achievement of the determined
purposes and at the same time the purpose of data processing must be secured using the methods
that interfere with the fundamental rights of the person as little as possible. For that, the
controller must always assess in advance whether the processing (disclosing) of the data is
inevitable for the fulfilment of the purpose or, is it possible to use less infringing measures.
In addition, also section 10 of the Personal Data Protection Act must be considered when
processing personal data in connection with violation of obligation. Subsection 10 (1) of the
Personal Data Protection Act stipulates the following: “Transmission of personal data related
to violation of any obligation to third parties and processing of the transmitted data by any
third party is permitted for the purpose of assessment of the creditworthiness of the data subject
or for any other similar purposes and only in the case the controller or processor has verified
the accuracy of the data transmitted and the legal basis for transmission of personal data and
registered the data transmission”.
Based on the above, it is prohibited to disclose personal data of a debtor on webpages and
transmission of data is allowed only, if the conditions set out in subsection 10 (1) of the Personal
Data Protection Act have been met. In addition, also subsection 10 (2) of the Personal Data
Protection Act must be considered, before transmission of the data, which stipulate the
conditions that prohibit the transmission of data.
Accordingly, by disclosing the personal data, the requirements of the Personal Data Protection
Act and the General Data Protection Regulation were violated.
In light of the above, incl. the fact that now the personal data related to the violation of
obligation have been removed from the webpage, we issue a reprimand to
in accordance with Article 58 (2) b) of the General Data Protection Regulation and draw
attention to the following:
1. In processing the personal data, the controller must proceed from the General
Data Protection Regulation, incl. Articles 5 and 6. Personal data processing is lawful
only, if at least one of the conditions set out in Article 6, paragraph 1 of the GDPR has
been complied with. Regardless of the legal grounds, the controller must also proceed
from all of the principles of processing the personal data, set out in Article 5 of the
GDPR.
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
2. Upon transmission of personal data related to violation of any obligation, Article
10 of the Personal Data Protection Act must be considered. At the same time,
disclosing the data related to violation of an obligation is prohibited.
Furthermore, we draw attention also to the fact that responding to the inquiries made within the
supervision proceedings is mandatory and when responding, the deadline given by the
administrative authority must be complied with. In the event that there are problems with
responding to the inspectorate by the determined deadline, it is also possible to explain to the
supervision authority the objective circumstances that were an obstacle. Simply not responding
and failure to adhere to the deadlines, however, are not acceptable and may lead to imposing a
penalty payment.
Based on the above, we shall terminate the supervisory proceeding.
This decision may be challenged within 30 days by submitting one of the two:
- A challenge to the Director General of the Estonian Data Protection Inspectorate
pursuant to the Administrative Procedure Act1, or
- An appeal to an administrative court under the Code of Administrative Court Procedure2
(in this case, the challenge in the same matter can no longer be reviewed).
Respectfully
/signed digitally/
lawyer
authorised by Director General
1
https://www.riigiteataja.ee/en/eli/527032019002/consolide
2
https://www.riigiteataja.ee/en/eli/512122019007/consolide