idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
# Information and Data Protection Commissioner
vs
# COMPLAINT
1. On the \(4^{\text{th}}\) June 2019, (the "complainant") lodged a complaint through his lawyer with the Personal Data Protection Office of Poland (the "Polish SA") against (the "controller" or the "bank"). The complainant contended that he has received two (2) requests dated the \(25^{\text{th}}\) May 2019 and the \(28^{\text{th}}\) May 2019, wherein the bank requested payment in relation to a loan agreement. The complainant strongly denied that he has ever concluded a loan agreement with the bank despite the requests for payment suggesting otherwise.
2. The complainant alleged that the bank has obtained his personal data from an unspecified source and consequently, his personal data has been used in an unauthorised manner. The complainant further added that a third-party probably has misused his personal data and this fact has indeed been reported to the Polish Police. For this reason, the complainant requested the Polish SA to determine the manner in which his personal data has come into the possession of the controller, including the basis and reason for which these were processed.
3. On the \(30^{\text{th}}\) January 2020, the Polish SA lodged a mutual assistance notification under article 61 of the General Data Protection Regulation² (the “Regulation”), wherein the Information and Data Protection Commissioner (the “Commissioner”) acted in its capacity of the lead supervisory authority in the light of the fact the controller’s main establishment is in Malta.
² Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Airways House, Second Floor
High Street, Sliema SLM 1549
MALTA.
(+356) 2328 7100
[email protected]
www.idpc.org.mt
Page 1 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
4. As attachment to the above-mentioned notification, the Polish SA provided the Commissioner with a copy of the complaint. Subsequently, the Commissioner requested the Polish SA to provide additional correspondence, which the SA exchanged with the complainant's lawyer, including other related documentation. The Commissioner examined the letter sent by the complainant's lawyer to the bank³, dated the 4th June 2019, captioned the "loan agreement no. [REDACTED]" (the "loan agreement"), wherein the complainant referred to the request for payment dated the 28th May 2019, and:
a. instructed the bank to discontinue addressing any more letters or requests, and to desist from taking any action towards him in relation to the claims arising from the loan agreement, which the complainant said he has never signed;
b. informed the bank that the unlawful use of his personal data has been reported to the Police;
c. notified the bank that he did not consent to the processing of his personal data, and consequently, this matter has been referred to the Polish SA; and
d. informed the bank that in the event of non-observance of the above, the complainant may institute judicial proceedings.
5. On the 23rd July 2019, the Polish SA contacted the complainant's lawyer requesting him to rectify certain shortcomings identified in the complaint, dated the 4th June 2019.
6. On the 29th July 2019, the complainant's lawyer responded to the Polish SA's request by submitting the following arguments:
a. that the complainant has never concluded any contract with the bank, and therefore he did not entrust the bank with his personal data;
b. that the bank has been notified by the complainant that he did not agree with the processing of his personal data⁴, and that the bank did not reply to such communication;
³ The English version of the letter that was forwarded to the Commissioner by the Polish SA.
⁴ Supra, para. 4(a) to 4(d).
Page 2 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
c. that the Polish SA should have determined from which source the bank has obtained the complainant's data, considering that he has never entered into any loan agreements with it; and
d. that the complainant was also expecting the Polish SA to order the erasure of his personal data undergoing processing by the controller.
# INVESTIGATION
7. On the 9th March 2020, by virtue of article 58(1) of the Regulation, the Commissioner requested the controller to provide its submissions on the allegations raised by the complainant. In terms of this Office's internal investigation procedure, the Commissioner provided the controller with a copy of the complaint and the supporting documents attached thereto.
8. On the 24th March 2020, the controller submitted the following salient legal arguments:
a. that on the 13th June 2019, the controller "received a notification letter from the District Police of Zywiec stating that had submitted an application that his personal data had been used illegally and, as a consequence, a loan agreement was concluded with the Bank in his name but without his knowledge. On the same day, 13.06.2019, after receiving the above-mentioned notification letter from the Police, the Bank immediately stopped all debt collection activities relating to the Complainant and made a note in its systems accordingly. By this date, the Bank had still not received the letter sent on behalf of the Complainant";
b. that on the 24th June 2019, the controller "received a letter from lawyer dated the 4th June 2019⁵ informing the Bank that had not concluded a loan agreement with the Bank and that the relevant notification to Police had been submitted. Furthermore, the lawyer requested the Bank to discontinue addressing any more letters, requests or taking any other actions in relation to on pain of action being taken against the Bank, in particular threatening the Bank with compensation claims";
⁵ The letter was sent by post on the 6th June 2019.
Page 3 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
c. that the controller has never replied to the complainant's letter, dated the 4th June 2019, as it was the bank's understanding that "as per action requested by representative, the Bank took notice in its systems to refrain from further contact with and as regards personal data processing. As there was no request to reply to either or his representative, the Bank refrained from such contact, also taking note the request of the lawyer in this respect, which seemed to indicate that correspondence from the Bank would be undesirable for his client";
d. in relation to the source from which the personal data related to the complainant was collected, the controller provided that "the loan application was submitted from IP address: to the Bank's website on 15.04.2019.
9. On the 26th March 2020, the Commissioner referred to the statement made by the complainant's lawyer, specifically that the complainant "does not consent to the processing of his personal data by you", and requested the controller to put forward further submissions concerning the technical measures which the bank has implemented to ensure that the personal data linked with the complainant, were not subject to any further processing operations.
10. On the 3rd April 2020, the controller submitted the following considerations for the Commissioner to assess:
a. "[a]s the complainant has requested to restrict the processing of his data, the Bank is not allowed to use his data, but we are permitted to store the personal data. In order to comply with the request, the Bank has extracted all the personal data linked to complainant's name
Page 4 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
b. the controller explained that “[t]he extracted data is then stored
”, and that “[t]he Bank-assigned client ID (this is not a personal identification number, but a number assigned to a customer when they are onboarded) and
; and
c. the controller concluded that “[t]he Bank has security procedures in place to monitor the access and use of personal data in Bank’s systems.
The principles of need-to-know and need-to-access as well as segregation of duties are enforced”.
11. On the 24th April 2020, the Commissioner requested the controller to describe the clients’ onboard verification process, briefly referenced by the controller in its previous submissions6, and to provide copies of any relevant policies and procedures, which the controller had in place. Additionally, the Commissioner requested the controller to specify the legal basis upon which the complainant’s personal data was being retained, and the envisaged retention period thereof.
12. In response, on the 30th April 2020, the controller submitted a copy of the onboard identification and verification process adopted by the bank for customers located in Poland, and a copy of its “Credit Fraud Management Policy”.
13. The Commissioner sought to establish whether the bank has complied with the clients’ onboard verification process, at the time when the application for the loan in the name of the complainant was submitted. On the 22nd September 2020, the Commissioner requested the controller to produce the following documentation and information:
6
Supra, para 8 (d).
Page 5 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
a. a copy of the loan application submitted by the applicant, in the name of the complainant;
b. a copy of the applicant's data, received by the controller by means of the bank payment;
c. a copy of the loan agreement signed by the applicant; and
d. the retention period established by the controller in connection with loan applications and agreements.
14. On the 28th September 2020, the controller submitted the requested documentation and information. In relation to the copy of the requested loan agreement signed by the applicant, the bank explained that, on the 15th April 2019, it sent to the complainant a copy of such agreement without the applicant's IBAN7, SECCI8 and other personal data and, following that, on the 16th April 2019, once the applicant's information was confirmed by means of receipt of a bank transfer9, the bank sent to the complainant an updated copy of the same loan agreement, including the information previously omitted. Accordingly, the controller provided the Commissioner with a copy of the two (2) versions of the loan agreement.
15. Additionally, the controller stated that "[t]he retention period for data related to loan's applications and agreements for the customers served in Poland is 10 years from the date when the account is closed". In this regard, the controller explained that it has defined such retention period on the basis of the following:
a. the IDPC and Malta Bankers' Association, Data Protection Guidelines for Banks (May 2018), according to which "all account data is to be retained for a period of ten years from the date of closure of the respective account [...] subject to Article 163 of the Companies Act, Cap. 386; articles 4(11) and 4(13) of the Cooperation with Other Jurisdictions on Tax Matters Regulations (S.L. 123.127); and to article 19 of the Income Tax Management Act, Cap. 372". The controller pointed out that in the same guidelines, "account data is defined as electronic data which relates to all aspects of
7 International Bank Account Number.
8 Standard European Consumer Credit Information sheet.
9 Supra, footnote 5.
Page 6 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
an account, excluding transaction data” and that “the information composed and gathered during the loan agreement signing process and concluded that most of the information and documentation is already composed and saved in electronic way, thus typically the Bank does not hold any information in paper format”. Therefore, the controller concluded that “both, account data and information should be retained for 10 years from the data of closure of the respective account”;
b. the Polish Act on the Amendment to the Civil Code Act and certain other Acts of 13 April 2018¹⁰ (the “Act”). The controller explained that the Act amended the basic rules concerning limitation periods for civil law claims from 6 (six) to 10 (ten) years. The controller further provided that the Act applied to “agreements in international transactions when the parties subject the agreement to Polish law or when according to Rome I regulations Polish law applied”. On this point, the controller stressed that notwithstanding the fact that the loan agreement is governed by Maltese legislation, the consumer’s rights under Polish law are also applicable, as stipulated in article 26 of the loan agreement, and therefore, the duration of the retention period for account data and information has to be in line with the statutory deadline to bring proceedings against the bank under the applicable Polish law; and
c. Regulation 13(2) of Prevention of Money Laundering and Funding or Terrorism Regulations (S.L. 373.01), which establishes “a period of 5 years for retaining the documentation, data or information described in the same article 13(1) paragraph (a) as of the date the business relationship ends”.
### LEGAL ANALYSIS AND DECISION
16. For the purpose of this legal analysis, the Commissioner examined the initial complaint received by the Polish SA, including the additional correspondence¹¹ dated the 29th July 2019, and on the basis of this complaint, the Commissioner established that:
a. the complainant requested the controller to specify the source from which his personal data connected with the loan agreement has been obtained;
¹⁰ Polish Journal of Laws 2018, item 1104.
¹¹ The English version of the correspondence received by the Commissioner from the Polish SA.
Page 7 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
b. the complainant exercised his right to restriction of processing pursuant to article 18 of the Regulation, when he stated that he did not consent to the processing of his personal data by the controller;
c. the complainant pointed out that he did not receive any response from the bank to its letter dated the \(4^{\text{th}}\) June 2019, by means of which, he exercised his right to restriction of processing, as mentioned above; and
d. the complainant stated that he expected the Polish SA to order the erasure of his personal data processed by the controller.
# Determining the source of the complainant's personal data
17. The Commissioner examined article 15(1)(g) of the Regulation, which stipulates that “[t]he data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: [...] (g) where the personal data are not collected from the data subject, any available information as to their source” [emphasis has been added].
18. Whereas the data subject has a right to obtain from the controller information in relation to the source from where his personal data has been collected, however such right is tied to the exercise of the right of access in terms of article 15 of the Regulation.
19. After examining the content of the letter dated the \(4^{\text{th}}\) June 2019, which the complainant sent to the controller, the Commissioner concluded that the complainant did not in any way exercise his right to access in terms of article 15 of the Regulation, and therefore, the controller was not legally obliged to provide the information concerning the processing within the period stipulated under article 12(3) of the Regulation.
20. Nonetheless, it should be remarked that, during the course of the investigation, the controller provided to the Commissioner information in relation to the source from where the complainant's personal data was obtained$^{12}$.
¹² Supra, para. 8(d).
Airways House, Second Floor
High Street, Silema SLM 1549
MALTA.
(+356) 2328 7100
[email protected]
www.idpc.org.mt
Page 8 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
# The request to restrict the processing of personal data
21. The Commissioner examined article 4(3) of the Regulation, which defines “restriction of processing” as “the marking of stored personal data with the aim of limiting their processing in the future”.
22. Article 18 of the Regulation provides that the data subjects shall have the right to restrict the processing of their personal in certain circumstances. Accordingly, the Commissioner carefully examined article 18(1) of the Regulation, which stipulates that the “data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: […] (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead”.
23. Furthermore, the Commissioner assessed article 18(2) of the Regulation, which explains the consequences triggered following a request to restriction filed by a data subject, wherein the restricted personal data “shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State”.
24. Recital 67 of the Regulation sheds further light on the methods of how the controller may restrict personal data, which may include, inter alia, “temporarily moving the selected data to another processing system, making the selected personal data unavailable to users, or temporarily removing published data from a website”. Insofar as automated filing systems are concerned, the same recital establishes that “restriction of processing should in principle be ensured by technical means in such a manner that the personal data are not subject to further processing operations and cannot be changed. The fact that the processing of personal data is restricted should be clearly indicated in the system”.
25. In the letter dated the 4th June 2019, the complainant notified the controller that he did not consent to the processing of his personal data, and therefore, the complainant exercised a valid request in terms of article 18 of the Regulation, wherein he requested the controller to restrict the processing of his personal data after flagging the processing activity as unlawful.
Page 9 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
26. During the course of the investigation, the Commissioner observed that the controller acknowledged that the complainant exercised his right to restriction of processing¹³ and in fact, the controller provided the Commissioner with information on the action taken to effectively comply with the complainant’s request and restrict the processing of his personal data¹⁴.
# The lack of response by the controller
27. Having assessed that article 12 of the Regulation ensures that substantive rights of data subjects, including the right to restrict processing, are safeguarded by establishing clear, proportionate and effective conditions as to how and when data subjects shall exercise these rights. In this regard, article 12 of the Regulation provides the modalities for the exercise of the data subjects’ rights and establishes an obligation upon the controller to facilitate the exercise of these rights.
28. Accordingly, the Commissioner examined article 12(3) of the Regulation, which aims at ensuring the efficient exercise of data subjects’ rights and binds the controller to “provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request.”. This period may be extended to a maximum of three (3) months when the controller is handling a complex request in so far as the data subject has been informed about the reasons for such delay within one (1) month from the date of the original request.
29. From the contents of the documents provided by the complainant, including the submissions provided by the controller, the Commissioner concluded that the complainant’s letter dated the 4th June 2019, by means of which, the complainant exercised his right to restriction of processing, was not responded to. The fact that the complainant’s letter was never replied to, was in fact acknowledged by the controller in its submissions¹⁵.
30. The Commissioner analysed the reason provided by the controller for not responding to the complainant’s letter and the related request to the right to restrict processing¹⁶. In this respect,
¹³ Supra, para. 10(a).
¹⁴ Supra, para. 10(b) and 10(c).
¹⁵ Supra, para 8(c).
¹⁶ Ibidem.
Page 10 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
the controller alleged that a reply was not provided because “there was no request to reply to either [REDACTED] or his representative […] also taking note the request of the lawyer in this respect, which seemed to indicate that correspondence from the Bank would be undesirable for his client”.
31. Having noted the statutory nature of the controller’s obligation derived from article 12(3) of the Regulation, and also taking into account that such obligation may not be waived in the event that the enquiring data subject does not include an explicit request to receive a response.
32. Having additionally established that the complainant’s lawyer instructed the bank to discontinue addressing to the complainant any more letters or requests or taking any action towards him in relation to the claims arising from the loan agreement, and not in relation to the request to restrict processing, which is a right exercised by the complainant in terms of article 18 of the Regulation [emphasis has been added].
# The request to order the erasure of the personal data
33. In terms of article 17(1) of the Regulation, the “data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” where one of the grounds listed in article 17(1)(a) to (f) applies. This rule is subject to a number of exceptions, including article 17(3)(b) thereof which states that the right to erasure shall not apply “for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject […]” [emphasis has been added].
34. Having observed recital 41 of the Regulation, which stipulates that “[w]here this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to requirements pursuant to the constitutional order of the Member State concerned. However, such a legal basis or legislative measure should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union (the ‘Court of Justice’) and the European Court of Human Rights” [emphasis has been added].
Page 11 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
35. Having considered the European Data Protection Board's position¹⁷ in relation to article 17(3)(b) of the Regulation, according to which the notion of "unlawful processing" "shall secondly be interpreted broadly, as the infringement of a legal provision other than the GDPR. Such interpretation must be conducted objectively by Supervisory Authorities, according to national laws or to a court decision" [emphasis has been added].
36. Having given due regard to the information supplied by the controller during the course of the investigation concerning the retention period of the personal data processed within the context of loan applications and agreements¹⁸, and that the controller stated that the retention period is that of ten (10) years, starting from the date of the closing of the account. The controller also specified that such retention period was based on legal obligations to which it is subject deriving from Maltese law¹⁹.
On the basis of the foregoing, the Commissioner hereby decides that:
a. the complainant did not exercise his right to access pursuant to article 15 of the Regulation;
b. by means of the letter dated the 4th June 2019, the complainant requested the controller to exercise his right to restriction of processing in terms of article 18 of the Regulation;
c. the controller infringed article 12(3) of the Regulation when it failed to provide the complainant with information on the action taken on the aforesaid request within the period stipulated by law;
d. the complainant's request to order the erasure of his personal data undergoing processing could not be met at the time of the issuance of this legally-binding decision, on the basis that the processing of the complainant's personal data is necessary for compliance with the legal obligations to which the controller is subject.
¹⁷ European Data Protection Board, Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1), Version 2.0, Adopted on 7 July 2020, para. 36, page 9.
¹⁸ Supra, para. 15.
¹⁹ Ibidem.
Page 12 of 13
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
In terms of article 58(2)(b) of the Regulation, the controller is hereby being served with a reprimand and informed that in case of a similar infringement, the Commissioner shall take the appropriate corrective action, including the imposition of an administrative fine.
By virtue of article 26(1) of the Data Protection Act (Cap. 586 of the Laws of Malta), any person to whom a legally binding decision of the Commissioner is addressed, shall have the right to appeal in writing to the Information and Data Protection Appeals Tribunal within twenty days from the service of the said decision as provided in article 23 thereof.
Decided today, the 2nd day of September, 2021
Page 13 of 13