5 February 2020
Georgenstraße 35
10117 Berlin J.No. 2019-7320-1396
Germany Doc.no. 179147
Caseworker
Sent by Independent Data Protection Center Schleswig-Hol-
stein - Lander Commissioner for Data Protection
Complaint about data breach
The Danish Data
Protection Agency
You have filed a complaint to The Independent Data Protection Center Schleswig-Holstein - Carl Jacobsens Vej 35
Lander Commissioner for Data Protection regarding the controller Garnio ApS (hereinafter 2500 Valby
Denmark
Hobbii ApS, as Garnio ApS changed its name on 8 April 2019). In accordance with Article 56
T 3319 3200
of the General Data Protection Regulation 1, the Danish Data Protection Agency (hereinafter
0F
[email protected]
the Danish DPA) has been designated as the leading supervisory authority of the case. datatilsynet.dk
The Danish DPA understands that you have requested Hobbii ApS for access to your personal
data in accordance with Article 15 of the General Data Protection Regulation, after which Hob-
bii ApS has sent you personal data regarding another person. The Danish DPA understands
that you have contacted Hobbii ApS about the breach but the company has not reacted to your
inquiry.
It is the understanding of the Danish DPA that you wish to complain about you having received
personal data regarding another person.
1. Decision
The Danish DPA can inform you that according to Section 39(1) of the Danish Data Protection
Act2, the data subject or the data subject’s representative may lodge a complaint with the com-
petent supervisory authority concerning the processing of personal data concerning the data
subject, as prescribed by Article 77 of the General Data Protection Regulation. This means
that you are only entitled to complain about processing of personal data that concerns you.
After a review of your inquiry, the Danish DPA finds that you are not entitled to complain, as
the processing of personal data is not related to you, but instead is related to the person of
whom you received the data.
The Danish DPA has taken notice of the security problem and breach of personal data de-
scribed and it will be included in the Danish DPAs ongoing considerations about which cases
the Danish DPA will take during our own operations of audits.
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural per-
sons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation).
2 Act No. 502 of 23 May 2018 – Act on supplementary provisions to the regulation on the protection of natural persons with re-
gard to the processing of personal data and on the free movement of such data (the Data Protection Act)
Kind regards Page 2 of 4
Appendix: Legal basis.
Page 3 of 4
Appendix: Legal Basis
Extracts from Act No. 502 of 23 May 2018 – Act on supplementary provisions to the
regulation on the protection of natural persons with regard to the processing of per-
sonal data and on the free movement of such data (the Data Protection Act)
Section 39(1) The data subject or the data subject’s representative may lodge a complaint
with the competent supervisory authority about the processing of data concerning the data
subject, as prescribed by Article 77 of the General Data Protection Regulation.
(2) Decisions made by the supervisory authorities or their failure to consider a complaint from
a data subject or their lack of reporting can be brought before the courts by the data subject
or the data subject’s representative to be considered under the rules of the administration of
civil justice as set out in Article 78 of the General Data Protection Regulation.
(3) The data subject or the data subject’s representative may bring issues of whether data
controllers or data processors comply with this Act before the courts to be considered under
the rules of the administration of civil justice as set out in Article 79 of the General Data Pro-
tection Regulation.
Extracts from Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of natural per-sons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation).
Article 15(1) The data subject shall have the right to obtain from the controller confirmation as
to whether or not personal data concerning him or her are being processed, and, where that
is the case, access to the personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will
be disclosed, in particular recipients in third countries or international organisations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if
not possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of per-
sonal data or restriction of processing of personal data concerning the data subject or
to object to such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the data subject, any available infor-
mation as to their source;
(h) the existence of automated decision-making, including profiling, referred to in Article
22(1) and (4) and, at least in those cases, meaningful information about the logic in-
volved, as well as the significance and the envisaged consequences of such process-
ing for the data subject.
(2) Where personal data are transferred to a third country or to an international organisation,
the data subject shall have the right to be informed of the appropriate safeguards pursuant to
Article 46 relating to the transfer.
(3) The controller shall provide a copy of the personal data undergoing processing. For any
further copies requested by the data subject, the controller may charge a reasonable fee based
on administrative costs. Where the data subject makes the request by electronic means, and Page 4 of 4
unless otherwise requested by the data subject, the information shall be provided in a com-
monly used electronic form.
(4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights
and freedoms of others.
Article 77(1) Without prejudice to any other administrative or judicial remedy, every data sub-
ject shall have the right to lodge a complaint with a supervisory authority, in particular in the
Member State of his or her habitual residence, place of work or place of the alleged infringe-
ment if the data subject considers that the processing of personal data relating to him or her
infringes this Regulation.
(2) The supervisory authority with which the complaint has been lodged shall inform the com-
plainant on the progress and the outcome of the complaint including the possibility of a judi-
cial remedy pursuant to Article 78.