R O MÂNI A
AUTORITATEA NAŢIONALĂ DE SUPRAVEGHERE
A PRELUCRĂRII DATELOR CU CARACTER PERSONAL
Bld. Gen. Gheorghe Magheru Nr. 28-30, Sector 1, Cod poştal 010336, Bucureşti ; Tel. +40.31.805.9211; Fax:+40.31.805.9602 www.dataprotection.ro; e-mail: [email protected]
ANSPDCP.Registrul Evidenta Decizii Avize
Recomandari.0000031.30-08-2021
Decision
following the investigation carried out at
Cylex Tehnologia Informației Internațional Societate în Nume Colectiv
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal,
having the premises at 28-30 Gen. Gheorghe Magheru Blvd., 1 st District, PO 010336, Bucharest,
legally represented by Mrs. , President issues this decision against
Cylex Tehnologia Informației Internațional Societate în Nume Colectiv, with the premises
in Palota village, Sîntandrei Commune, no. 119/A, Bihor County, Unique registration code 26332771,
registered at the Trade Register Office under no. J5/1591/2009, legally represented by Mr.
, as administrator.
Considering the following:
I. PREMISE
1. Intimation pursuant to Article 56 of GDPR
By the IMI application no. 159285 (registered at the Autoritatea Naţională de Supraveghere a
Prelucrării Datelor cu Caracter Personal under no. 21372 of the 28th of October 2020), pursuant to
Article 56 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation
– hereinafter “GDPR”), in order to identify the lead supervisory authority (LSA) and of the concerned
supervisory authorities (CSA), the Polish Data Protection Authority (DPA) has informed all EU
authorities that it has received a complaint against Cylex International Information Technology
Societate în Nume Colectiv , enclosing evidence to that effect, in the English and Polish languages.
DPA Poland considers the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter
Personal (hereinafter referred to as “ANSPDCP”) as the lead supervisory authority (LSA) in this case,
given the fact that this company is based in Romania. DPA Poland also mentioned that the website
is also available in Norwegian, French, Spanish, German, Slovak and Swedish. The proposal of the
DPA Poland proposal was accepted by ANSPDCP.
2. Object and assessment of the complaints
Mrs. lodged a complaint with the Polish authority on the 4 th of August
2019 claiming that her personal data (name, surname, profession, address, a form of legal
organisation which is no longer valid) are published, inter alia, on the website cylex-polska.pl. The
petitioner addressed by e-mail invoking Articles 17 and 21 of the GDPR in order to obtain the
deletion of these data that were published without her consent and information. The request was
sent in Polish from the address to the address [email protected] on the 13 th of June
2019.
It is noted that the cylex site, owned by Cylex Tehnologia Informației Internațional
Societate în Nume Colectiv (hereinafter referred to as "Cylex"), through which are made
public also the personal data of natural persons from different EU Member States, is available in
various versions of European domain names and in the national languages of the EU Member States
(such as: Romanian, French, Italian, Finnish, Spanish, German, Slovak, Swedish, Hungarian, Polish,
Czech, Danish, Dutch), thus carrying out cross-border processing in the meaning of Article 4 point
23 of the GDPR. Considering that the Cylex headquarters is in Romania, ANSPDCP is the lead
supervisory authority in this case, within the meaning of Articles 56, 60 and the following of the
GDPR.
3. Investigation at Cylex Tehnologia Informației Internațional Societate în Nume
Colectiv
Pursuant to Articles 57 and 58 of the GDPR and of Article 14 and the following from Law no.
102/2005 on the set up, organisation and functioning of the National Authority for the Supervision of
Personal Data Processing, republished, it was ordered to carry out an investigation to handle the
issues reported to the supervisory authority.
ANSPDCP sent the investigation letter to Cylex no. 1304 of the 22 nd of January 2021,
completed with the letter no. 5510 of the 26 th of March 2021.
Cylex replied with the letter no. 22 of the 15 th of February 2021, registered at ANSPDCP
under no. 3051 of the 19 th of February 2021, completed with the answer registered at ANSPDCP
under no. 5534 of the 26 th of March 2021.
Cylex’s representatives stated the following:
- the identification elements of Mrs. from the CYLEX catalogue were:
the name of the professional, the address declared as headquarters of the professional,
the KRS registration number in the Polish Trade Register of the professional, the NIP
number meaning the fiscal attribute of the professional, issued by the Polish authorities,
the field of activity (Laboratories – Services);
- Cylex collected these information from the public database of the Polish Trade Register
(Statistic);
- Cylex does not object to the deletion of data either they come from companies or they
belong to other categories of professionals;
- the deletion option is accessible from the profile of the professional, without the need to
notify Cylex;
- by error, the request of Mrs. was not processed properly, whereas
the e-mail from the 13 of June 2019 went directly into spam; whereas the amount of
th
spam e-mails is very large, the moderators have omitted to open and process the e-mail;
usually, such requests are processed within 24 hours on weekdays or 72 hours on
weekends and holidays;
- consequently, Cylex found out about the petitioner’s request after receiving ANSPDCP’s
letter, i.e. on the 5 th of February 2021; as such, Cylex deleted without delay all data
belonging to the professional and a submitted a request of deletion from Google cache; it
has also taken measures to ensure that all e-mails are read and processed with the
utmost rigor;
- Cylex informed the petitioner of the measures adopted by e-mail, on the 10 th of February
2021.
Following the investigation carried out, pursuant to Article 60 (3) of the GDPR, ANSPDCP
communicated electronically on the 7th of May 2021 a draft decision and the response sent by Cylex
to the other personal data protection authorities in the European Union, the authorities in Berlin
(and Bavaria) and Poland making relevant and reasoned objections on the 4 th of June 2021.
2
By taking into account the objections thus formulated, in accordance with Article 60 (4) of
the GDPR, ANSPDCP revised the draft decision, resulting in this decision.
4. Replies of other supervisory authorities in IMI
A. In the notification based on Article 56 of IMI with no. 159285 (opened on the 27 th of
October 2020), in addition to the Polish authority, the following authorities were
declared concerned authorities: Norway, Ireland, Germany - Lower Saxony, Belgium,
Italy, Germany - Mecklenburg-Western Pomerania, France, Germany - Berlin, Slovakia,
Sweden, Spain, Germany - Bavaria, Finland, as the processing would or could
substantially affect the data subjects in their country.
Apart from the Polish authority, no other authority has stated that is has received any
complaints against Cylex.
B. Following the introduction of a first draft of the decision issued by ANSPDCP in IMI
(Article 60 295321 - introduced on the 7 th of May 2021), the authorities in Berlin (and
Bavaria) as well as the Polish authority raised relevant and reasoned objections to IMI,
with the proposal to ascertain the violation, mainly, of the provisions of Articles 6, 14, 12
(3), 17 (1), 24 of the GDPR.
The Italian authority also commented on the procedural issues (form of the draft decision).
C. Following the objections raised, ANSPDCP revised the draft decision and reintrod uced it in
IMI (Article 60 311339 - introduced on the 15 th of July 2021), and the Berlin authority stated that it
agrees with the proposed measures. As no other relevant and reasoned objections were raised, this
final decision was issued.
5. The minutes of the finding
Following the investigation carried out and the consultations carried out with the other
personal data protection authorities, the finding report no. 14199 of the 9 th of August 2021 by whic h
the following facts were ascertained was concluded:
1. ”At the date of these minutes, it is noted that Cylex International Information
Technology Societate în Nume Colectiv , with the headquarters mentioned on the
first page of these minutes, did not handled the request of Ms.
of the 13 th of June 2019, formulated based on Article 17 of the GDPR, respectively,
did not send a reply within the deadlines provided by Article 12 (3) of the GDPR,
the request being effectively resolved between the 5 th and 10 th of February 2021,
according to the findings of these minutes. Pursuant to Article 24 of the GDPR, the
controller is obliged to “implement appropriate technical and organisational
measures to ensure and to be able to demonstrate that the processing is
performed in accordance” with the GDPR, including “appropriate data protection
policies”, which must include appropriate and effective measures to ensure that
any request received at the address provided publicly as a contact to be assessed
and handled under the conditions and deadlines provided by Articles 12-22 of the
GDPR.
This deed constitutes the contravention provided by Article 12 of Law no. 190/2018, by
reference to the provisions presented in Article 83 (5) letter b) of the GDPR.
2. At the date of these minutes, it is noted that Cylex Tehnologia Informației
Internațional Societate în Nume Colectiv , with the headquarters mentioned on the
first page of these minutes, has not presented evidence so far that is has provided
complete information and in compliance with the provisions of Articles 12-14 of the
GDPR to Mrs. , including information regarding the legal basis
3
of the processing provided by Article 6 of the GDPR, whose personal data were
available on cylex-polska.pl until the period 5 th – 10th of February 2021.
This deed constitutes the contravention provided by Article 12 of Law no. 190/2018, by
reference to the provisions presented in Article 83 (5) letter b) of the GDPR.”
Since in this case Cylex International Information Technology Societate în Nume Colectiv
performs a cross-border processing, the provisions of Article 60 of Regulation (EU) 679/2016, as well
as those of Article 16 (3), (5), (6), (7) of Law no. 102/2005, republished, which provide for the
application of sanctions / corrective measures by dec ision of the president of ANSPDCP, which is
based on the minutes of the finding and the report of the control staff, become applicable.
II. REASONS:
Having regard to the conclusions of the investigation carried out at Cylex International
Information Technology Societate în Nume Colectiv,
Taking into account the relevant and reasoned objections raised by the other concerned
supervisory authorities in IMI,
Based on the aspects retained and recorded in the minutes of finding no. 14199 of the 9 th of
August 2021, according to which:
1. ” Cylex’s representatives declared that they manage over 30 catalogues of online companies,
with a database of over 60 millions companies (companies, institutions and other legal
forms), having millions of clients all around the world”; “the CYLEX catalogue of companies is
a search engine, in the sense that, specifically, the public records are accessed online and
transferred to the CYLEX company catalog. In terms of features, the web catalog does not
differ significantly from other search engines, such as Google, which also captures company
pages and displays the related data in their link pages”;
2. the purpose declared by the Cylex’s representatives by processing these information is to
offer “users a quick and easy way to find anywhere the products and services they are
looking for, the purpose of the undersigned being to facilitate connections between
companies and customers”, so that entities can benefit from free registrations to promote
their companies online and to gain customers”;
3. Cylex’s representatives also declared that “Cylex catalogs do not target data of individuals
but strictly of professionals”, the information being collected from public databases such as
the trade registers from different countries;
4. in the case of professionals (as was the case with Mrs. ), the information
collected and published in Cylex ’s online catalog also includes first and last name, address,
other contact details, which allow the identification of a natural p erson and therefore
constitute “personal data”, in the meaning of the definition given by Article 4 point 1 of the
GDPR (“any information concerning an identified or identifiable natural person (“data
subject”); an identifiable natural person is a person who can be identified, directly or
indirectly, in particular by reference to an identifying element, such as a name, an
identification number, location data, an online identifier, or one or more specific elements,
specific to his physical, physiological, genetic, mental, economic, cultural or social identity”);
5. consequently, all situations in which Cylex processes information that allows the identification
of individuals, even if they are related to their professional activity, fall within the material
scope of the GDPR, according to Article 2 (1);
6. as such, Cylex is obliged, as a personal data controller, to ensure the legality of the data
processing of these persons, according to Articles 5 and 6 of the GDPR, to provide complete
information, “in a concise, transparent, intelligible and easily accessible form, using a clear
and simple language”, according to Articles 12-14 of the GDPR, including information
regarding the processing of data of these persons and, respectively, to respect the rights of
these persons, as they are provided by Articles 15-22 of the GDPR, facilitating, at the same
time, their exercise;
4
7. in this regard, it is necessary to duly supplement the existing information on each language
version of the sites belonging to Cylex, on which online catalog ues containing personal data
of these persons are made available to the public;
8. according to Articles 13 and 14 of the GDPR, among the information that must be brought to
the knowledge of the data subjects is also the legal basis of the processing, which must be
established by reference to the provisions of Article 6 of the GDPR;
9. the legitimate interest (Article 6 (1) (f) of the GDPR) may constitute a valid legal basis in so
far as the criteria set out in recital (47) of the GDPR are met: “The legitimate interests of a
controller, including those of a controller to which the personal data may be disclosed, or of a
third party, may provide a legal basis for processing, provided that the interests or the
fundamental rights and freedoms of the data subject are not overriding, taking into
consideration the reasonable expectations of data subjects based on their relationship with
the controller. Such legitimate interest could exist for example where there is a relevant and
appropriate relationship between the data subject and the controller in situations such as
where the data subject is a client or in the service of the controller. At any rate the existence
of a legitimate interest would need careful assessment including whether a data subject can
reasonably expect at the time and in the context of the collectio n of the personal data that
processing for that purpose may take place. The interests and fundamental rights of the data
subject could in particular override the interest of the data controller where personal data are
processed in circumstances where data subjects do not reasonably expect further processing.
(...) ”;
10. 10. in situations where, following the evaluation carried out by the controller, it is concluded
that the legitimate interest does not meet these criteria, the only legal basis allowed for the
data processing of the above mentioned persons is the consent of the data subjects (Article 6
(1) letter a) of the GDPR);
11. regarding the particular situation reported, of Ms. , although her request
of the 13 of June 2019 reached the computer system of Cylex (in the spam folder), it was
th
not handled within the legal deadlines provided by Article 17 (1) and Article 12 (3) of the
GDPR (maximum one month or maximum 3 months), deleting her data and sending a reply
taking place much later, after receiving the ANSPDCP letter no. 1304 of the 22 nd of January
2021, respectively, during 05.02.2021-10.02.2021; from the 8 th of February 2021, ac c ording
to the statements of the Cylex ’s representatives, measures were taken so that “all e-mails
are read and processed with maximum rigour”;
12. therefore, until the 8 th of February 2021, Cylex did not “implement” adequate technical and
organisational measures to ensure and to be able to demonstrate that processing is
performed in accordance” with the GDPR, including “appropriate data protection policies”, as
provided by Article 24 of the GDPR; thus, it is the obligation of the controller to implement
appropriate and effective measures to ensure that any request received at the address
provided publicly as a contact to be assessed and handled under the conditions and
deadlines provided by Articles 12-22 of the GDPR;
13. or, in the case of Mrs. , her request made based on Article 17 of the
GDPR was not handled by Cylex without delay, respectively, within the deadlines provided by
Article 12 (3) of the GDPR;
14. also, although ANSPDCP requested this information through the letter no. 1304 of the 22 nd of
January 2021, Cylex did not present evidence regarding the provision of information to Mrs.
whose personal data were published on the website cylex -polska.pl,
according to the provisions of Articles 12-14 of the GDPR and according to the above
considerations in this context;
15. this conduct of the controller must be sanctioned, in order to avoid the recurrence of similar
incidents in the future and to prevent the violation of the rights of other persons whose
personal data they process. When imposing the sanction, it will be taken into account that,
according to the records of ANSPDCP, no other similar complaints were received against
Cylex regarding the exercise of rights under the GDPR, the above circumstances, the
categories of data concerned and the fact that the controller took measures in order to
remedy the notified issues”,
5
Pursuant to Articles 14, 15 and 16 of Law no. 102/2005, republished, of Article 12 of Law no.
190/2018, in conjunction with Article 83 (2) and with the dispositions listed in Article 83 (5) letter b)
of Regulation (EU) 679/2016, corroborated with the provisions of Article 58 (2) letters b) and d), as
well as of Article 60 of Regulation (EU) 679/2016, related to the provisions of Articles 24, 25 and 26
of the Investigation Procedure, approved by the Decision of the President of ANSPDCP no.
161/2018,
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
ORDERS
the following measures against Cylex Tehnologia Informației Internațional Societate în
Nume Colectiv:
1. Issuing a reprimand for the deed ascertained through the minutes no. 14199 of the 9 th of
August 2021, based on Article 58 paragraph (2) letter b) of Regulation (EU) 2016/679, by
reference to the infringement of Articles 17 and 12 (3) of this Regulation;
2. Issuing a reprimand for the second deed ascertained through the minutes no. 14199 of
the 9 th of August 2021, based on Article 58 paragraph (2) letter b) of Regulation (EU)
2016/679, by reference to the infringement of Articles 12-14 of this Regulation;
3. Imposing the corrective measure provided by Article 58 (2) letter d) of Regulation (EU)
2016/679 to implement appropriate technical and organisational measures in order to
ensure and to be able to demonstrate that processing is performed in accordance with
the GDPR, including appropriate data protection policies, which shall include appropriate
and effective measures so that any request received at the address provided publicly as a
contact shall be assessed and handled under the conditions and deadlines provided by
Articles 12-22 of the GDPR – deadline: 30 days from the date of communication of this
decision;
4. Imposing the corrective measure provided by Article 58 (2) letter d) of Regulation (EU)
2016/679 to ensure the legality of the processing of data of natural persons whose
personal data are available through online catalogues, according to Articles 5 and 6 of
the GDPR and to provide complete information “in a concise, transparent, intelligible and
easily accessible form, using a clear and simple language”, pursuant to Articles 12-14 of
the GDPR, regarding the processing of data of these persons, respectively, to respect the
rights of these persons, as they are provided by Articles 15-22 of the GDPR, facilitating,
at the same time, their exercise; in this regard, it is necessary to properly supplement the
existing information on each language version of the sites belonging to Cylex
International Information Technology Societate în Nume Colectiv , on which online
catalogues are made available to the public – deadline: 30 days from the date of
communication of this decision.
Cylex Tehnologia Informației Internațional Societate în Nume Colectiv shall
communicate to ANSPDCP the measures adopted for the implementation of the corrective measures
within 45 days from the communication of this decision.
This decision was subject to the procedure provided for in Chapter VII of Regulation (EU)
2016/679, being sent for approval to all concerned supervisory authorities.
This decision, together with the minute no. 14199 of the 9 th of August 2021 shall be
communicated to Cylex Tehnologia Informației Internațional Societate în Nume Colectiv
that has the right to challenge them pursuant to Article 17 of Law no. 102/2005:
”Article 17
(1) The data controller or processor may file an appeal against the report of the finding/sanctioning
and/or the decision to apply the corrective measures, as the case may be, with the administrative
6
contentious section of the competent court, within 15 days from handing, respectively from
communication. The decision resolving the appeal can be appealed only by appeal. The appeal is
judged by the competent court of appeal. In all cases, the competent courts are those in Romania.
(2) The report of finding/sanctioning or the decision of the president of the National Supervisory
Authority unchallenged within 15 days from the date of handing, respectively the communication,
constitutes an enforceable title without any other formality. Introducing the appeal provided in
paragraph (1) suspends only the payment of the fine, until a final court decision is issued.
(3)The deadline of payment of the fine is 15 days from the date of handing, respectively from the
date of communication of the minutes of finding/sanctioning or of the decision of the president of
the National Supervisory Authority.”
President,
7