FOR THE PROTECTION OF PRIVACY AND THE TRANSPARENCY OF THE STATE
Your: 17/12/2020
Our: 01/07/2021 No. 2.1.-1/18/3288
Notice of termination of the proceedings in a case concerning the protection of personal
data
Through the cross-border proceedings system IMI, the Estonian Data Protection Inspectorate
(the Inspectorate) received a complaint from ,
pursuant to which is illegally collecting and using the complainant’s
personal identification code in their information system, incl. has added it to a contract. The
complainant finds that adding personal identification codes to contracts is excessive, illegal,
and poses a risk to the security of personal data. They find that has no
specific grounds for processing personal identification codes and such processing should take
place only with the consent of the data subject. In this specific case, the complainant has not
consented to the processing of their personal identification code.
Based on the above, we have initiated supervision proceedings on the basis of clause 56 (3) 8)
of the Personal Data Protection Act.
Throughout the supervision proceedings, we submitted an enquiry to , in
which we asked the following:
1. What is the legal basis (show the specific legal provision) for
processing the personal identification code of the complainant in their information
system (incl. added it to a contract)?
2. If finds that processing the personal identification code of the
complainant is not lawful, they should explain whether and which measures are
implemented to resolve the situation.
In their response to the enquiry of the Data Protection Inspectorate, said
the following:
Article 3 of the Lithuanian Law on Legal Protection of Personal Data establishes the
specificities of managing personal identification codes, pursuant to which personal
identification codes may be processed if one of the conditions of lawfulness established in
Article 6(1) of the GDPR is met.
Disclosing personal identification codes is prohibited, as is processing personal identification
codes for the purposes of direct marketing.
is a client of with whom
a contract for the provision of service has been concluded (Annex 1).
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registry code 70004235
FOR THE PROTECTION OF PRIVACY AND THE TRANSPARENCY OF THE STATE
In accordance with the above, processes the personal data of the
complainant pursuant to the contract concluded with the client. [...] In this situation, Article
3(1) of the Lithuanian Law on Legal Protection of Personal Data and Article 6(1)(b) of the
GDPR apply; the latter states that processing of personal data (incl. personal identification
codes) is lawful if the processing is necessary for the performance of a contract to which the
data subject is party or to take steps at the request of the data subject prior to entering into a
contract.
has processed the personal identification code of the complainant lawfully.
Pursuant to the submitted complaint and considering the response from , we
also asked for the opinion of the Lithuanian Data Protection Authority on whether, in their
assessment, has breached legislative requirements.
On 10 February, the Lithuanian Data Protection Authority replied as follows: In our opinion,
the provisions of the Law on Legal Protection of Personal Data of the Republic of Lithuania do
not apply in the present case, because data controller is not established in
Lithuania. The lawfulness of the processing of the data referred to in the complaint should be
assessed in accordance with Estonian law and GDPR.
–
We wish to clarify that legal grounds for the processing of personal data can be based on Article
6(1) of the General Data Protection Regulation (GDPR). Thereat, the person’s consent is only
one of the possible legal grounds. However has noted that the legal grounds
for processing personal data was not the consent of the complainant, but Article 6(1)(b) of the
GDPR, pursuant to which personal data (incl. personal identification codes) may be processed
if it is necessary for the performance of a contract. We also wish to note that adding a personal
identification code to a contract and/or an annex to a contract is required for the unambiguous
identification of the person (user of the service).
As has received the personal data of the complainant upon the conclusion
of the contract and processed data lawfully (for the conclusion and performance of a contract),
we find that the processing of the personal identification code was lawful in this specific case.
For this reason, we are terminating the supervision proceedings.
This administrative act can be disputed within 30 days by:
- submitting a challenge to the Director General of the Data Protection Inspectorate pursuant to
the Administrative Procedure Act1 or
- filing a petition with an administrative court pursuant to the Code of Administrative Court
Procedure2 (in this case, any challenges submitted in the same case can no longer be processed).
Respectfully
/signed digitally/
Lawyer
Authorised by the Director General
1
https://www.riigiteataja.ee/en/eli/527032019002/consolide
2
https://www.riigiteataja.ee/en/eli/512122019007/consolide
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registry code 70004235