21 June 2021
J.No. 2020-7320-1776
Doc.no. 347085
Caseworker
Complaint regarding processing of personal data
The Danish Data
Protection Agency
The Danish Data Protection Agency hereby returns to the case where (here- Carl Jacobsens Vej 35
inafter: the complainant) have complained to the Norwegian Data Protection Agency about 2500 Valby
Denmark
Orbit Group Aps’ (hereinafter: Pixojet). In accordance with Article 56 of the General Data Pro-
T 3319 3200
tection Regulation (hereinafter: GDPR), The Danish Data Protection Agency has been ap- dt@datatilsy net.dk
pointed as the lead supervisory authority in the case. datatilsy net.dk
VAT No. 11883729
The Danish Data Protection Agency has understood the complainant’s inquiry as a complaint
about that Pixojet has not handled his request for access in accordance with the data protec-
tion rules.
1. Decision
After a review of the case, the Danish Data Protection Agency finds that there are no grounds
for criticising Pixojet’s processing of the complainant’s personal data.
Below is a detailed examination of the case and a statement of reasons for the Danish Data
Protection Agency’s decision.
2. Relevant facts
It appears from the file that the complainant received a newsletter from Pixojet on 28 November
2019.
The same day, the complainant asked Pixojet to inform where Pixojet had obtained his email
address.
Pixojet informed the complainant that he had signed up for Pixojet’s newsletter and that Pixojet
would like to remove his subscription again.
The complainant then informed Pixojet that he had never signed up for their newsletter and
then asked for information about when he had subscribed to the newsletter and from which
source.
When Pixojet did not reply to the complainant, the complainant again - on November 29 2019
- requested an answer to where Pixojet had his information. In the same context, he pointed
out to Pixojet that he continued to receive Pixojet newsletters.
On 2 December 2019, the complainant again requested Pixojet to inform where Pixojet had Page 2 of 3
obtained his email address. To this, a customer service employee at Pixojet replied that he
could not be sure, but that it looked like a manual registration from the complainant.
2.1. Comment from the complainant
The complainant have stated that he had never heard of Pixojet until he received Pixojet’s
newsletter.
He does not believe that he have subscribed to the Pixojet newsletter, and Pixojet should
therefore be able to declare where they have his email address.
He suspect that Pixojet has acquired his email address in a manner contrary to the data pro-
tection rules. In this connection, he have stated that he is entitled to access, including infor-
mation about the basis of Pixojet’s processing of information about him. It is most likely that
his email address has been disclosed by another actor who also processes information about
him. Pixojet should provide him with information on the origin of the information so that he can
check whether he have given his consent to the transfer.
2.2. Pixojet’s comments
Pixojet has stated that, according to the GDPR, the company may not store information about
the complainant when he wishes to be deleted from its system.
Pixojet has not made any further comments on the matter.
3. Reasoning for the decision of The Danish Data Protection Agency
As a general rule, data subjects have the right to obtain confirmation by the data controller of
whether personal data relating to the person concerned is being processed and, if applicable,
access to the personal data and a number of additional information in accordance with Article
15 of the GDPR. In accordance with paragraph 1(g) of that provision, the data subject shall
have the right to obtain any information available on the origin of the personal data if it is not
collected from the data subject.
The Danish Data Protection Agency has understood the complainant’s complaint as that he is
of the opinion that Pixojet has not given him access in accordance with Article 15 of the GDPR.
The Danish Data Protection Agency finds no grounds to disregard Pixojet’s assessment that
the complainant’s inquiries of 28 November 2019, 29 November 2019 and 2 December 2019
should not be understood as a request for full access under Article 15 of the GDPR.
The Danish Data Protection Agency has thereby placed emphasis on the wording of the com-
plainant’s inquiries, which states that he were interested in knowing specifically where Pixojet
had his e-mail address.
Furthermore, the Danish Data Protection Agency finds that Pixojet has informed the complain-
ant by 28 November 2019 and 2 December 2019 that the information about him was probably
from a manual entry to Pixojet’s newsletter on the company’s website.
On the basis of the information provided by the case, it is noted that the Danish Dat a Protection
Agency has no basis for assuming that Pixojet has any additional information on the source of
information about the complainant. In addition, it is noted that the Danish Data Protection
Agency only deals with cases on a written basis, and the agency therefore has no opportunity
to determine whether or not he has signed up for Pixojet’s newsletter. This decision has been
taken on the basis of the material presented.
Page 3 of 3
It is the view of the Data Protection Agency that the subject matter of the complaint has been
investigated to the extent appropriate in accordance with Article 57(1)(f) of the GDPR.
The Danish Data Protection Agency does not find sufficient basis for criticising Pixojet’s han-
dling of the complainant’s inquiries.
However, in connection with the complaint, the Danish Data Protection Agency will be inform-
ing Pixojet that processing of personal data requires a legal basis under Article 6 of the GDPR.
Furthermore, The Danish Data Protection Agency will point out that personal data must be
processed in accordance with the principles in Article 5(1) of the GDPR, which implies, inter
alia, that personal data must be processed lawfully, proportionately and transparently in rela-
tion to the data subject as referred to in Article 5(1)(a). In this context, The Data Protection
Agency will alert Pixojet to the fact that the controller is responsible for and must be able to
ensure compliance with the fundamental principles referred to in Article 5(2) of the GDPR. This
implies, inter alia, that the controller must be able to demonstrate that personal information is
processed legally, proportionately and in a transparent manner.
The Danish Data Protection Agency has also noted that Pixojet has stated that the complain-
ant’s personal data has subsequently been deleted.
4. Final remarks
The Danish Data Protection Agency’s decision may be appealed to the courts.
A copy of this letter will be sent to Pixojet.
The Danish Data Protection Agency considers the case to be closed and does not proceed
any further.
Kind regards,