FOR DATA PRIVACY AND FREEDOM OF INFORMATION
Your: 17/12/2020
Our: 03/06/2021 nr 2.1.-1/20/61
Notice of termination of the proceeding in regard to the protection of personal data
The proceeding of the Estonian Data Protection Inspectorate concerned the claim of a Lithua n ia
citizen (complainant) in regard to the fact that the
transferred the personal data of the complainant about his dept to without
informing about debt.
Given the above, we initiated a supervision proceeding on the basis of clause 56 (3) 8) of the
Personal Data Protection Act.
In its response to the inquiry from the Estonian Data Protection Inspectorate,
stated that it did not violate the Personal Data Protection Act or the General Data
Protection Regulation, but acted in accordance with the laws and the contract concluded with
the client.
During the proceeding, stated the following:
1. ( ) was a client of , who ordered
the service of ( ) by concluding a service provision contract with
on 10.07.2010. On 18.03.2013, terminated the
contract with the complainant due to a debt.
processes the appellant’s personal data (name, surname, address,
telephone number, and personal identification code) based on the concluded contract
and law in order to perform the contract and recover the debt.
2. On 16 September 2019, forwarded the complainant’s personal data
to in accordance with the contract concluded with the
3. Clause 12.3 of the contract concluded with the client highlights that
has the right to transfer, without the consent of the client, its contractual rights and
obligations to third parties, provided that the transfer does not violate the client’s rights.
The client’s rights have not been violated, as upon conclusion of the contract, it was
agreed that the client will receive the service and will be paid for
the service provision. If the debt for the service remains unpaid, the service provider
has the right to demand the payment of debt that the client had to take into account
when concluding the contract. The same option is also provided in subsection 164 (1)
the Law of Obligations Act, establishing that an obligee may transfer the claim thereof
to another person on the basis of a contract in part or in full regardless of the consent
of the obligor (assignment of claim). A claim shall not be assigned if assignment is
prohibited by law or if the obligation cannot be performed for the benefit of any other
person but the original obligee without altering the content of the obligation. The client
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registry code 70004235
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
failed to pay the debt, after which transferred the debt to a person
processing debts, and in this case, to for debt recovery purposes.
offers credit management services. As entered into an
agreement with then the new creditor and the data controller is
4. had the right to transfer the personal data to in
accordance with the agreement with the client and law (in point 3). On 15 October
2019, informed the complainant that had transferred
the complaint´s personal data to , therefore the new creditor and the data
controller is .
has explained to the Estonian Data Protection Inspectorate that it received
the complainant’s data in connection with the conclusion of a contract with him for the use of
the service and shall process such data to perform the contract – for debt recovery purposes.
As the complainant failed to pay the debt, his details were transfered to the with
whom had a debt collection contract.
Information that may transfer the complaint’s data to third parties without
his consent has already been communicated to the complainant upon conclusion of the contract
(clause 12.3 of the contract). It is clear from the response of that the
complainant was notified by on the transfer of the debt on 15 October 2019.
In addition, the Estonian Data Protection Inspectorate examined the correspondence forwarded
by the complainant. It appears from the correspondence that the complainant has been provided
with documents, which, in the opinion of , prove the incurrence of the debt.
Therefore, has replied to the complainant and the Inspectorate did not find
a violation of Article 15 of the GDPR.
The Estonian Data Protection Inspectorate also explains that with regard to processing of
personal data, it only assesses whether the transfer of personal data has been lawful, not the
lawfulness of the debt claim. The Estonian Data Protection Inspectorate does not have the
competence to assess whether the debts of individuals against the creditor have arisen lawfully,
what the claims consist of, whether or not the debt has actually been liquidated, whether or not
the rules for the assignment of the claim have been complied with, as those are disputes that
arise from contractual relations. Settlement of contractual disputes between private parties is a
matter for the civil court.
As has received personal data from the complainant at the time of
concluding the contract and processes such data lawfully (for the purpose
of concluding and performing the contract) and the complainant has been informed of the
transfer of personal data or the possibility thereof, we find that the processing of the
complainant’s personal data was lawful. Therefore, we shall terminate the supervisor y
proceeding.
This decision may be challenged within 30 days by submitting one of the two:
- A challenge to the Director General of the Estonian Data Protection Inspectorate
pursuant to the Administrative Procedure Act1 , or
- An appeal to an administrative court under the Code of Administrative Court Procedure 2
(in this case, the challenge in the same matter can no longer be reviewed).
1 https://www.riigiteataja.ee/en/eli/527032019002/consolide
2 https://www.riigiteataja.ee/en/eli/512122019007/consolide
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registry code 70004235
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
Respectfully
/signed digitally/
authorised by the Director General
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registry code 70004235