FOR DATA PRIVACY AND FREEDOM OF INFORMATION
Your: 23.12.2020 no 2021-12-23-001
Our: 03.03.2021 no 2.1.-1/20/4520
Notice of termination of the proceeding in regard to the protection of personal data
The proceeding of the Estonian Data Protection Inspectorate concerned the claim of a Lithuania
citizen (complainant) in regard to the fact that the
transfer data of the complainant about his dept to , without
informing about debt.
Given the above, we initiated a supervision proceeding on the basis of clause 56 (3) 8) of the
Personal Data Protection Act.
In its response to the inquiry from the Estonian Data Protection Inspectorate,
stated that it did not violate the Personal Data Protection Act or the General Data
Protection Regulation, but acted in accordance with the laws and the contract concluded with
the client.
During the proceeding, stated the following:
1. was a client of , who ordered the service of
(former ) by concluding a service provision contract with on
04.08.2011. On 19.06.2015, terminated the contract with the
complainant due to a debt.
processes the appellant’s personal data (name, surname, address,
telephone number, and personal identification code) based on the concluded contract
and law in order to perform the contract and recover the debt.
2. On 16.09.2019, forwarded the complainant’s personal data to
in accordance with the contract concluded with the .
3. Clause 12.3 of the contract concluded with the client highlights that
has the right to transfer, without the consent of the client, its contractual rights and
obligations to third parties, provided that the transfer does not violate the client’s rights.
The client’s rights have not been violated, as upon conclusion of the contract, it was
agreed that the client will receive the service and will be paid for
the service provision. If the debt for the service remains unpaid, the service provider has
the right to demand the payment of debt that the client had to take into account when
concluding the contract. The same option is also provided in subsection 164 (1) the Law
of Obligations Act, establishing that an obligee may transfer the claim thereof to another
person on the basis of a contract in part or in full regardless of the consent of the obligor
(assignment of claim). A claim shall not be assigned if assignment is prohibited by law
or if the obligation cannot be performed for the benefit of any other person but the
original obligee without altering the content of the obligation. The client failed to pay
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
the debt, after which transferred the debt to a person processing
debts, and in this case, to for debt recovery purposes.
offers credit management services. entered into an
agreement with then the new creditor and the data controller is
.
4. had the right to transfer the personal data to in
accordance with the agreement with the client and law (in point 3). On 22 October 2019,
informed the complainant that had transferred the
complaint´s personal data to , therefore the new creditor and the data
controller is .
-
has explained to the Estonian Data Protection Inspectorate that it received
the complainant’s data in connection with the conclusion of a contract with him for the use of
the service and shall process such data to perform the contract – for debt recovery purposes.
As the complainant failed to pay the debt, his details were transfered to the with
whom had a debt collection contract.
Information that may transfer the complaint’s data to third parties without
his consent has already been communicated to the complainant upon conclusion of the contract
(clause 12.3 of the contract). It is clear from the response of that the
complainant was notified by on the transfer of the debt on 22 October 2019.
The Estonian Data Protection Inspectorate also explains that with regard to processing of
personal data, it only assesses whether the transfer of personal data has been lawful, not the
lawfulness of the debt claim. The Estonian Data Protection Inspectorate does not have the
competence to assess whether the debts of individuals against the creditor have arisen lawfully,
what the claims consist of, whether or not the debt has actually been liquidated, whether or not
the rules for the assignment of the claim have been complied with, as those are disputes that
arise from contractual relations. Settlement of contractual disputes between private parties is a
matter for the civil court.
As has received personal data from the complainant at the time of
concluding the contract and processes such data lawfully (for the purpose
of concluding and performing the contract) and the complainant has been informed of the
transfer of personal data or the possibility thereof, we find that the processing of the
complainant’s personal data was lawful. Therefore, we shall terminate the supervisory
proceeding.
This decision may be challenged within 30 days by submitting one of the two:
- A challenge to the Director General of the Estonian Data Protection Inspectorate
pursuant to the Administrative Procedure Act1, or
- An appeal to an administrative court under the Code of Administrative Court Procedure 2
(in this case, the challenge in the same matter can no longer be reviewed).
Respectfully
/signed digitally/
1
https://www.riigiteataja.ee/en/eli/527032019002/consolide
2
https://www.riigiteataja.ee/en/eli/512122019007/consolide
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
lawyer
authorised by Director General