Final decision
The present decision refers to the complaint of . lodged with the supervisory authority of
Germany, Rhineland-Palatinate, (national reference 4.02.19.092) and submitted to the
Luxembourg supervisory authority via IMI under Article 56 procedure 66577.
The complaint was lodged against the controller (hereinafter
“ ”), which has its main establishment in Luxembourg. Pursuant to Article 56 of the GDPR,
the Luxembourg National Data Protection Commission (“CNPD”) is therefore competent to act as
lead supervisory authority.
Scope of the complaint and assessment of the case
The initial wording of the complaint on IMI stated that:
“The complainant alleges that he could not pay by but only by direct debit. Consequently,
he immediately interrupted the procedure and did not enter his banking details. However, the
following day the parcel arrived that he has not ordered and there was also a debit from his bank
account. Thus, the complainant wonders how got his data, especially his banking details.
Apparently, the complainant contacted and apologised but nevertheless, the
complainant is not happy with the situation.”
The complaint is thus based on Article 15 of the GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the
issue relating to the complainant’s data processing as per Article 58.1 a) of the GDPR, in particular
further information regarding the origin of the personal data processed by and, more
specifically, how obtained his payment data.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, has demonstrated that:
The complainant opened a customer account related to the e-mail address [known by the
CNPD] and registered his bank account details on 16 September 2016. He subsequently
subscribed to a “ membership” and placed four orders, including the order described
in the complaint.
For all four orders, the records show that selected direct debit as the preferred
payment option, which entailed the use of the bank account details had previously
provided.
For the order described in the complaint, the complainant clicked t
to complete the order; otherwise the order number would not have been generated. In
general, customers receive an order confirmation via e-mail and have the option
to cancel any order after placing it.
The complainant did not cancel the order and did not send any other message to
so the order was processed and shipped.
is not an accepted payment method on . This is explicitly stated on the
customer help page concerning available payment options.
Thus, based on the information that was provided, the CNPD did not identify any infringement by
the controller of the obligations set out in Regulation (EU) 2016/679 (GDPR).
In light of the above, the CNPD has consulted the supervisory authority of Rhineland-Palatinate
(Germany) to determine whether the case could be closed. The CNPD and the supervisory
authority of Rhineland-Palatinate (Germany) agreed that, in view of the above, no further action
is required and that the cross-border complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 294013).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission