Case number:
Antecedent case number: NAIH/2020/4409.
In charge:
Budapest
.
1075
Honourable .,
As you have earlier been informed, the Nemzeti Adatvédelmi és Információszabadság Hatóság
(Hungarian National Authority for Data Protection and Freedom of Information, hereinafter: Authority)
received a complaint through the Austrian Data Protection Author ity, in which the complainant
(hereinafter: Complainant) submitted that he bought a at the cash desk
of . (registered office: 1075 Budapest, ; hereinafter: Company)
located at the in person on 17 July 2018. In the course of this, the staff member
of the Company requested him to provide the number of his identification document because he would
not be able to buy the pass without it, therefore the Complainant met the request.
According to the Complainant, the number of his identification document was recorded not only on his
pass, but also in the Company’s systems; in his view the Company did not have the appropriate legal
basis for this and it also infringes the principle of data minimisation. In addition, he also objected to the
fact that he did not receive proper information on the processing of the number of his identification
document.
Based on Article 57(1)(f) of the General Data Protection Regulation (h ereinafter: GDPR) and Section
38(3)(a) of Act CXII of 2011 on the Right to Informational Self -Determination and the Freedom of
Information (hereinafter: Privacy Act), an investigation was launched into the case.
I. The course of the procedure
On 8 February 2019, the Austrian Data Protection Authority initiated a procedure to establish the lead
and concerned supervisory authorities in accordance with GDPR Article 56 under number A56 ID 59796.
In the procedure according to GDPR Article 56 the Authority ind icated on 7 March 2019 that it accepts its
designation as lead supervisory authority in this case and at the same time requested the Austrian
authority to make the original complaint and all other relevant documents with their English translations
available to it, as in the absence of these documents and information it would not be able to conduct the
procedure. The Austrian authority failed to respond to this request, though in order to conduct a
procedure, the Authority initiated a mandatory mutual assistance procedure in accordance with GDPR
Article 61 under No. A61 125465 IMI in the “Internal Market Information System” designed for the
exchange of information among data protection supervisory authorities on 14 May 2020. The period open
…………………………………………………………………………………………………………
1055 Budapest Phone: +36 1 391-1400 [email protected]
Falk Miksa utca 9-11. Fax: +36 1 391-1410 www.naih.hu
2
for responding expired on 14 June 2020, but the Austrian authority did not formally accept the Authority’s
request.
On 13 August 2020, the Authority uploaded its draft decision to the IMI system, in which it rejected the
complaint as obviously unfounded based on the available information.
Following the disclosure of the draft decision on 19 August 2020, the Austrian authority uploaded the
documents earlier requested by the Authority in German and in English. At the same time, a staff member
of the Austrian authority contacted the Authority by a-mail, informally indicating that they failed to respond
to the Authority’s request for information because of administrative error, and that they believed that the
draft decision was unacceptable as there was no investigation on the merits of the case.
Based on the documents sent, the Authority decided to conduct an investigation on the merits of the case
and withdrew its draft decision No. A60 144159 IMI.
In its letter dated 30 September 2020, the Authority informed . that an investigative procedure
would be launched in the case and called upon . to make statements in order to clarify the facts
of the case. The statement by . was received by the Authority on 19 October 2020.
II. The facts of the case
According to Section I.4 of the Rules of Business, there are two legal relationships that regulate the
performance of the passenger transport service used by the passenger. One is covered by the network
availability contract, which comes into being between the Company and the passenger, whereby the
passenger obtains the right to use the transport network organised by the Company , that is, to travel
using the vehicles of the Company or of the contracted service provider partner of the Company, and
undertakes the obligation to pay the price of the ticket or pass due to the Company.
The passenger transport service contract comes into being between the passenger and the service
provider operating the vehicle, on the basis of which the service provider undertake s to carry the
passenger to the destination with its scheduled vehicles.
The pass as a document entitling the holder to travel verifies with respect to the legal relationship
according to the valid passenger transport contract and the network availability contract whether the
passenger makes use of the services according to the Rules of Business of the Company rightfully. To
decide this, the Company has to check the validity of the pass not only with respect to the given period
and route network, but it is also indispensable that the Company check whether the valid pass is used by
the person entitled to do so. It follows that the pass can only be used – according to the choice of the
passenger 1 – together with a pass ID with photo issued by the Company, ID card, passport or driving
licence in a card format, 2 whose number has to be recorded by printing on the pass voucher upon its sale
according to Section 3.3 of the Company’s tariffs.
When checking the pass, it has to be presented to the person authorised to check together with the pass
ID, ID card, passport, etc. According to the Company, failure to record the document identifier on the
pass would greatly increase the risk of abuse of non-transferable passes.
The Company informed the Authority that its sales system does not store the identifier numbers given
upon the purchase of the pass – it did not do so on 17 July 2018 – in order to enforce the principle of data
1
Rules of Business Section V.1.2.
2
Rules of Business of (in force: 25 October 2017 - 15 January
2019; hereinafter: Rules of Business) definition according to Section 1.2.
3
minimisation according to GDPR Article 5(1)(c). It follows that the Company does not process the
personal data of the Complainant.
The computer system at the cash desks and the ticket vending machines only print the document identifier
to be given upon purchase to the pass voucher; once the printing is done which takes a few seconds
only, the document identifier is erased from the temporary memory of the printer. After printing, the data
are not recorded in an electronic format or in a data matrix code.
The Company stated that in its view, it does not carry out data processing when printing the document
identifiers on the pass vouchers and because of this, it provides information to the passengers on this not
in its Privacy Statement but in its Rules of Business. The Rules of Business can be accessed in the
website of the Company, in its central customer service, its customer centres and at the cash desks.
III. The findings of the Authority
III.1. Processing carried out by the Company
According to GDPR Article 4(2) “processing” means any operation or set of operations, which is
performed on personal data or on sets of personal data, whether or not by automated means, such as
collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination or otherwise through availability, alignment or
combination, restriction, erasure or destruction.
According to the position of the Authority, distinction has to be made between the two cases when a
person buys a pass at the cash desk from a staff member of the Company as the Complainant did, or
when he or she buys the pass from a ticket vending machine.
In the first case, the Company staff member while doing his job learns the document identifier either
through dictation or by looking at the document used for purchasing the pass, such as a passport, and
typing it into the ticket sale system enters it on the pass voucher. In the course of this operation,
processing is carried out as the staff member of the Company learns the document identifier as described
above either by inspecting it or hearing it as it follows from his job and in relation to it.
When the pass is purchased from a vending machine, it is the passenger himself who types the document
identifier on the touch screen of the machine, that is, he does not disclose it to a third person, no third
person learns the document identifier.
Irrespective of whether the passenger buys the pass at the cash desk or from the ticket vending machine,
in order to display the document identifier on the pass voucher by way of printing, the document identifier
has to be stored in the memory of the printer for the period of printing, upon the completion of which the
document identifier is erased. During this period, however, the data are stored and it follows that even if
for a very short period of time, the Company does carry out data processing.
Beyond this, however, the Company does not collect and does not store document identifiers, it does not
process them after printing the pass voucher, thus the further processing of the document identifiers as
pseudonym data does not take place as assumed in the Complainant’s complaint.
III.2. The lawfulness of processing: necessity
4
The purpose of indicating a document identifier on the pass voucher is that only one passenger should
be able to use the pass voucher, thereby reducing the possibility for abuse.
Document identifiers are unique identifiers, through which a pass voucher and a document with which it
is used together can be linked excluding any doubt while the document identifies the passenger who is,
the data subject, in other words, the document identifier is the appropriate and relevant data from the
viewpoint of the purpose of processing.
According to the position of the Authority, printing the document identifier on the pass voucher – and the
data processing carried out for a minimum period of time needed for this, in the given case, learning it by
a staff member of the Company and storing it for a few seconds in the memory of the printer – is necessary
to prevent abuse and to identify the person entitled to use the pass voucher and it is proportionate to the
purpose to be achieved.
The Authority is officially aware that early in the 2010s when there were no ticket vending machines,
passengers could buy pre-printed pass vouchers at the cash desks of the Company, and they themselves
had to write their document identifiers on them; then the Company did not carry out any kind of data
processing. This sales method, however, greatly increased the risk of abuse as many people did not write
their document identifiers on the pass voucher, or did so in a ma nner that could be modified later; thus
the pass voucher could be used not only by the person originally entitled to do so, for instance passengers
frequently transferred passes no longer used by the passenger buying the pass, but still valid, causing a
loss of revenue to the Company.
Based on the above, the Authority establishes that the processing of the document identifier , including
the number of the ID card of the Complainant does not infringe the principle of data minimisation as it is
a piece of relevant data from the viewpoint of achieving the desired purpose, it is necessary to achieve
that purpose and in compliance with the principle of limited storage processing takes place only for the
period of time needed to achieve the purpose, that is, until the document identifier is printed on the pass
voucher.
III.3. The legal basis of processing
Section 7(4)(a) of Act XLI of 2012 on Passenger Transport Services (hereinafter: Passenger Transport
Act) states that the authorisation of the transport service provider providing public passenger transport
service extends, inter alia, to the identification data of the natural person, such as the surname and given
name, surname and given name at birth, place and date of birth, mother’s surname and given name a t
birth, his address, as well as the type and number of his official certificate suitable for the identification of
the person with a view to performing the contract serving as the basis of the passenger transport service.
The Passenger Transport Act authorises transport service providers providing public passenger transport
services, including the Company to process the document identifiers of the passengers entering into
contract with it within the framework of performing the passenger transport contract with a view to
enabling the checking of the person’s right to travel, the identification of the person entitled to travel with
a pass voucher and identification during checks.
It is stated in Section 24 of Guideline 2/2019 EDPB that in the context of a contractual relationship there
may be a variety of purposes for processing.
5
According to Section 26 of the Guideline, a controller can rely on Article 6(1)(b) to process personal data
when it can establish, in line with its accountability obligations under Article 5(2) , both that the processing
takes place in the context of a valid contract with the data subject and that processing is necessary in
order that the particular contract with the data subject can be performed. According to Section s 27 and
30 of the Guideline, in order to be able to apply GDPR Article 6(1)(b) , it is important that the processing
of the data be objectively necessary for a purpose that is integral to the delivery of that contractual service
to the data subject. The controller should be able to demonstrate how the main object of the specific
contract with the data subject cannot as a matter of fact be performed, if the specific processing of the
personal data in question does not take place. The important issue here is the nexus between the
personal data and the processing operations concerned, and the performance or non -performance of the
service provided under the contract. 3
According to the position of the Authority, it is objectively necessary for the performance of the contract
that the Company be able to identify the other contracting party, i.e. the person who becomes entitled to
make use of the Company’s services by purchasing the pass in the course of checking the entitlement to
travel.
Based on the above, the Authority establishes that the Passenger Transport Act authorises the Company
to identify the party contracting by purchasing a pass and to check his entitlement to travel under a
passenger transport contract, and pursuant to GDPR Article 6(1)(b) the Company is entitled to process
the document identifier from the initiation of the pass purchase by the passenger until the printing of the
pass voucher.
III.4. Providing information on processing
Above, the Authority established that although for a very short time, the Company processes the
document identifiers of passengers buying non-transferable passes according to their choice. It follows
that the Company has an obligation to provide information according to GDPR Articles 13 and 14.
The Company does not dispute that it does not provide information on the processing of the document
identifier in the course of printing the pass voucher because in their view, they do not carry out data
processing in the course of this.
According to the Authority’s position, the Company has an obligation in most cases to provide information
according to GDPR Article 13 because characteristically everybody buys the pass for himself or for
herself, hence the Company collects the personal data from the dat a subject; however, there may be
cases when somebody buys a pass for a third person, in which case the Company has an obligation to
provide information according to GDPR Article 14.
According to GDPR Article 14(5)(a), the controller’s obligation to provid e information does not exist, if the
data subject already has the information. According to the Authority’s position, if a third person buys a
pass for a data subject, the data subject is doubtless aware that he made his document identifier available
to the third person for the purpose of buying a pass [GDPR article 14(1)(d) – categories of personal data
3
The Authority is aw are that the Guideline applies to contracts entered into for online services; however, according to the Au thority’s
position, the points thereof also apply in this case in connection w ith the “objectively necessary” condition required for the performance of
the service.
6
concerned in processing], and the source of the personal data is also known to him [GDPR Article
14(2)(f)].
It follows that the Company is not subject to an obligation to provide information on the above two
circumstances based on GDPR Article 14(5)(a) to the data subjects for whom another person buys a
non-transferable pass, whose data are given to be processed by the Company not by them.
In such cases, the Company would not be able to provide information of merit , i.e. relevant about the
source of the data, or in the given case, the Company is not even aware that the source of the document
identifier was not the data subject himself, for instance when a third person buys the pass for the data
subject from a ticket vending machine.
Based on this, the additional circumstances of data processing, on which the Company has to provide
information pursuant to GDPR Articles 13 and 14 are the same in the two articles, thus it will suffice for
the Company to draft a single item of information indicating exactly what data can be provided – such as
the number of the pass certificate, ID card, passport – irrespective of the fact that Article 13 does not
stipulate this as a requirement, and it would not be mandatory pursuant to Article 14(5)(a).
The Company indeed has a Privacy Statement, thus according to the Authority’s position, it may suffice
merely to supplement it with the investigated processing, in the course of which the following are relevant
among the of the circumstances listed in GDPR Articles 13 and 14, i.e. the Company has to provide
information about these over and above the information it already provides: the purpose of the planned
processing of personal data, the legal basis of processing, the period of storing the personal data and
whether the provision of personal data is based on legal regulation or contractual obligation, whether it is
a precondition to entering into contract and whether the data subject is under an obligation to provide the
personal data, and furthermore, what are the possible consequences of not providing the data. [GDPR
Article 13(1)(c), (2)(a) and (e)].
The Authority finds it necessary not to note that the purpose of processing can be inferred from the
Company’s Rules of Business, but according to the Authority’s position to ensure transparency, it is
necessary to inform the passengers of the above circumstances of the investigated processing in the
Company’s Privacy Statement.
Based on the above, the Authority establishes that the Company failed to meet its obligation to provide
information according to GDPR Articles 13 and 14 when it failed to provide information on the fact of
processing – in view of the fact that in its view it does not perform data processing – and of the
circumstances of processing listed by the Authority above.
III.5. Legal consequences
III.5.1. Based on GDPR Article 58(2)(b), the Authority reprimands the Company because it infringed its
obligation to provide information in accordance with GDPR Articles 13 and 14 when it failed to provide
information on the fact of processing the document identifiers and the circumstances of processing
indicated in Section III.4.
III.5.2. Pursuant to GDPR Article 58(2)(d) and Section 56(1) o f the Privacy Act, the Authority calls upon
the Company to provide information to the data subject on the fact of processing and its circumstances
according to GDPR Article 13(1)(c), 2(a) and (e) by supplementing its Privacy Statement, or if it so
chooses in a separate Privacy Statement.
7
The Authority informs the Company that pursuant to Section 56(2) of the Privacy Act, the Company has
to take the necessary measures indicated in this call if it agrees with them, and has to inform the Authority
of the measures taken and the evidence thereof, or if it disagrees of its position in writing within thirty
days from receipt of this call.
Pursuant to Section 58(1)-(2) of the Privacy Act, if the infringement is not remedied as a result of this
investigation and the direct threat of infringement is not terminated, the Authority will decide on taking
any necessary additional measures within thirty days following the expiry of the thirty-day period open to
provide information.
Budapest, “ ” 2021
Yours sincerely,
Dr. Attila Péterfalvi
President
Honorary university professor
8
Delivery clause to file number NAIH/
To:
To be
Name, mailing address of the addressee: Mode of mailing
attached
1.
To
registered letter
with
-
Budapest acknowledgement
of receipt
1075
2. - e-mail
3. Archives
- -