Final decision
The present decision refers to the complaint of lodged with the supervisory authority of
Austria (national reference D130.270) and submitted to the Luxembourg supervisory authority via
IMI under Article 56 procedure 70691.
The complaint was lodged against the controller (hereinafter
“ ”), which has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the
Luxembourg National Data Protection Commission (“CNPD”) is therefore competent to act as
lead supervisory authority.
Scope of the complaint and assessment of the case
In the initial complaint on IMI, the representative (lawyer) of the complainant sent a copy of the
letter in which he stated that the controller did not react to the access request as per Article 15
GDPR. More precisely, he explained that the complainant had an insurance relationship with the
controller, that the complainant exercised his right to access with e-mail from 29.10.2019 and that
the controller did not react to the request. The complainant requested in particular specific
documents as the insurance application, the original policy and the policy conditions relating to
the contract, the repurchase statement (etc).
The complaint is thus based on Article 15 GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the issue
relating to the complainant’s data processing as per Article 58.1 a), in particular as regards the
right of access of . to his personal data processed by the company, in particular by the
Austrian branch named . The CNPD requested to provide (1) to the
CNPD with the reasons why . has not been informed, within one month, of the actions
taken for his access request and (2) to act on access request, or provide CNPD with the
reasons that would justify not to act on this access request.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, the controller has given the
following explanations:
- The company (“ ”) has been recently set-up in Luxembourg
in order to allow the (“ ”), , to
continue to serve its in force European insurance portfolio post Brexit under EU
passporting rules. (“ ”), through its legacy
brand, previously distributed life insurance business to customers in the European
Economic Area (EEA) outside the United Lingdom. The principal markets were
.
- Incorporated on , obtained a life insurance licence from the
Luxembourg regulator (Commissariat aux Assurances) on .
- Effective , the in force European insurance portfolio transferred from
to (the “Transfer”). For the avoidance of doubt, any residual current or future
liabilities relating to closed (i.e. not in force) policies remained with .
- The policy of ., a , had started on 23 July 2007, was
assigned on 16 February 2016 and surrendered by the assignee on 8 August 2018. A
revocation request was made on 19 December 2018 and rejected on 18 January 2019. On
29 March 2019, this policy was no longer in force and so any residual liabilities therefore
remain with .
- indeed received the Data Subject Access request (“DSAR”) via a letter dated 21
November 2018 but the DSAR request was accidently closed rather than processed. No
communication has been sent to . or his lawyer and no contact has been made by
the lawyer requesting the DSAR until the receipt of CNPD letter. According to ,
measures have been taken at pace to understand the exact root cause and ensure this does
not happen again.
- then confirmed that it had acted on the DSAR request and that the relevant data pack
was posted using registered mail.
Thus, based on the information that was provided, the CNPD is of the view that the issue has been
resolved and that the controller has taken quick appropriate measures to satisfy the complainants’
right of access.
As the complaint had only a limited personal impact, the CNPD has consulted the supervisory
authority of Austria to determine whether the case could be closed. The CNPD and the supervisory
authority of Austria agreed that, in view of the above, no further action or additional measures are
needed and that the cross-border complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise or its investigative and corrective powers regarding the data
processing activities in the event of a new complaint.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 294704).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission