The Hamburg Representative for
Data protection and freedom of information
With postal delivery certificate
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 20459 Hamburg
Ludwig-Erhard-Str. 22, 7th floor
Peppermynt GmbH 20459 Hamburg
for the attention of Mr Phone: 040 - 428 54 - 40 51
Schwanenvik 14 Fax: 040 - 428 54 - 40 00
22087 Hamburg Contact person:
E-Mail:[email protected]
Ref: M1/1388/2021
Hamburg, 01.10.2021
Reprimand pursuant to Art. 58 (2) (b) GDPR
Dear Mr. ,
Pursuant to Art. 58 (2) (b) of the General Data Protection Regulation (GDPR), I hereby issue the
following
REPRIMAND
1. Peppermynt GmbH has infringed Article 12(3) and (4) of the GDPR by failing to provide in-
formation in accordance with Article 15(1) of the GDPR within one month and by the late
provision being incomplete.
2. Peppermynt GmbH is hereby formally reprimanded pursuant to Art. 58 (2) (b) GDPR on
the basis of the violations referred to under 1.
3. Peppermynt GmbH shall bear the costs of the proceedings. A separate decision will be
issued on the amount of the costs.
After examination of the factual and legal situation, there is a processing operation that violates the
GDPR. Pursuant to Article 58 (2) (b) of the GDPR, the controller may be reprimanded in the event
of an infringement.
Website: E-mail collective mailbox: Public Transportation:
www.datenschutz-hamburg.de [email protected] S-Bahn S1, S2, S3 (Stadthausbrücke station)
Underground U3 (St. Pauli station), buses 6 and
37
*Confidential information should only be sent to us electronically in encrypted form.
Our public PGP key is available on the Internet (fingerprint: 0932 579B 33C1 8C21 6C9D E77D 08DD BAE4 3377 5707)
2
I. Facts
On 29.12.2020 as well as on 4.1.2021 the complainant Mr. (hereinafter: Bf.) received one
e-mail each from the sender address [email protected], in which the products of Peppermynt
GmbH "Wunder Box" and "Gold Oase" were advertised. The e-mails contained individualised links,
including the phrase "why did I get this?“. The website called up via this gave the indication that the
e-mail address was assigned to a "Peppermynt player".
On 21.1.21 the complainant sent a request for information pursuant to Art. 15 GDPR to Peppermynt
GmbH by registered mail from Vienna. In this letter, the complainant requested information on which
of his personal data Peppermynt GmbH was processing, information on the processing, whether a
transfer to a third country was taking place and a copy of his personal data (Art. 15 (1)-(3) GDPR).
Peppermynt GmbH did not reply to the complainant's letter.
On 26 February 2021, the complainant filed a data protection complaint with the Austrian data pro-
tection authority. The latter forwarded the complaint to the HmbBfDI on 10 March 2021.
By letter dated 18.5.2021, the HmbBfDI heard Peppermynt GmbH on the proceedings. In this letter,
reference was made to the one-month period for the processing of data protection requests by data
controllers under Article 12 (3) sentence 1 of the GDPR.
On 4 June 2021, the of Peppermynt GmbH, , contacted the HmbBfDI
on behalf of the company. He stated that Peppermynt GmbH, as a young company, had no experi-
ence in responding to data protection requests and asked for support. The HmbBfDI informed the
complainant that the personal data processed would have to be made available.
In an e-mail dated 21.6.2021, Peppermynt GmbH informed the complainant that no "user" with the
complainant's e-mail address existed and that accordingly no personal data of the complainant was
stored.
Upon inquiry by the HmbBfDI with reference to the e-mails that the complainant had previously re-
ceived, Peppermynt GmbH explained that the complainant's e-mail address had been included in
Peppermynt GmbH's database due to an incorrect migration of the external service "Mailchimp", but
had now been deleted. The complainant would not receive any further e-mails from Peppermynt
GmbH in future.
3
II. Legal assessment
The prerequisites for a reprimand to be issued to Peppermynt GmbH pursuant to Art. 58 Para. 2 lit.
b GDPR are met.
1. Infringement of Art. 12 (3) sentence 1 GDPR
There is an infringement of Article 12 (3) sentence 1 of the GDPR. According to the provision, infor-
mation about requests pursuant to Art. 15-22 of the GDPR must be provided without delay, but in
any case within one month. Peppermynt GmbH did not respond to the complainant's request pursu-
ant to Art. 15 of the GDPR within one month.
2. Infringement of Article 15(1) of the GDPR
There is an infringement of Article 15 (1) of the GDPR. According to the provision, data subjects
have the right to request information about their personal data processed. The controller must pro-
vide this or provide negative information. 1 It is therefore not up to the data subjects to communicate
in which system of the controller the data might be stored.
In its information, Peppermynt GmbH informed the complainant that it did not process any of his
personal data. In deviation from this information, Peppermynt GmbH had, however, stored the com-
plainant's email address-. The email address is personal data in the sense of Art. 4 No. 1 GDPR.
The e-mail address is information which refers to the complainant as an identified person. The ne-
gative information was therefore issued incorrectly.
3. Decision-making and discretion
There are infringements of the GDPR, so that corrective powers pursuant to Art. 58 (2) GDPR are
to be taken. There are no reasons not to make use of these. This is the first finding by the HmbBfDI
that Peppermynt GmbH has violated the GDPR, so that the reprimand is to be chosen as the mildest
possible means.
With kind regards
Remedies:
An action against this decision may be brought before the Hamburg Administrative Court (Lübecker-
tordamm 4, 20099 Hamburg) within one month of notification.
1 Franck, in: Gola, Datenschutz-Grundverordnung, 2nd ed. 2018, Art. 15 Rn. 5.