Your: 25.03.2021
Member of the Management Board
Our: 17.11.2021 nr 2.1.-1/20/3013
Reprimand and notice of termination of the proceedings concerning the protection of
personal data
The Estonian Data Protection Inspectorate (the Inspectorate) received from the German data
protection authority a complaint through the IMI cross-border proceedings system concerning
the disclosure of the personal data of on the website
As is evident from the complaint, on 2 June 2021, the applicant forwarded a letter to the email
address , in which they stated, inter alia: I would like to politely request that
my personal data, i.e. my name, be removed immediately from the Google index and your site
in accordance with the general data protection regulation and to confirm this to me afterwards.
However, the complainant did not receive a reply to their letter and the personal data had not
been removed from the website.
Based on the above, we have initiated supervision proceeding on the basis of clause 56 (3) 8)
of the Personal Data Protection Act.
In the course of the supervision proceedings, explained the
following:
Sorry for the late answer your email is lost in the spam mailbox. Only when someone called us
today were we able to find it. I think it has to do with your attachment. It is not recognized by
our system as safe email.
We also found the person's original request for removal. The person writes from a strange email
, not from the email or domain from the person who posted
the job posting. There is no clear indication that it is his name in the job description. We have
no in our database; it is only entered text in vacancy and not recognized as a
personal name who could be associated with a particular person or ideated. That is why this
request has been put on hold. We had not received a follow-up from this person by email or
telephone. This situation is very far from our default working method.
Normally, publications disappear automatically from our index, which is exactly the case with
this vacancy. But I see that it is indeed not deleted from Google yet and therefore it can be
found in their cache. The vacancies have been closed and archived. They will also no longer
be available through urls. If you see it in your browser, please try to clean cache in your web
browser. Or open the url in incognito mode. We use and it is extremely
cached. See more information here.
We have checked everything manually and all listed jobs have been removed.
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
Sorry for the inconvenience, we will look at how we can prevent such situations in the future.
One such way is an opportunity to report vacancy. Each vacancy if it online has a button with
it is possible to report a vacancy without registration where people can enter details in a text
box and select the type of report.
We explain that it is the obligation of the data controller to make sure that data is processed in
compliance with the General Data Protection Regulation (GDPR). The controller is required to
provide information on action taken on a request under Articles 15 to 22 to the data subject
without undue delay and in any event within one month of receipt of the request (see
Article 12 (3) of the GDPR). In this case, the complainant requested the deletion of their
personal data in accordance with Article 17 of the GDPR, but
failed to reply to the complainant’s request. Therefore, the requirements set out in the GDPR
have not been met.
We also further clarify that in a situation where the controller is written from an unknown email
address and the person cannot be identified on the basis of the submitted information, the
controller has the right to request the submission of additional information necessary for
identification. However, failure to respond to the person’s request is not acceptable and
constitutes a violation of Article 12 (3) of the GDPR.
Therefore, did not comply with the requirements set out in the
GDPR. However, taking into account the above, including the content of the violation and the
fact that the personal data of the complainant has now been removed from the website
, we issue a reprimand to on the basis of
Article 58 (2) of the General Data Protection Regulation and point out the following:
The controller shall provide information on action taken on a request under Articles 15 to
22 to the data subject without undue delay and in any event within one month of receipt
of the request (see Article 12 (3) of the GDPR). In doing so, the data subject must be replied
to regardless of whether the person is identifiable or not. If the person is not identifiable, the
controller has the right to request the submission of additional information necessary for
identifying the person (see Article 12 (6) of the GDPR).
In view of the above, we shall terminate the supervisory proceeding.
This decision may be challenged within 30 days by submitting one of the two:
- A challenge to the Director General of the Estonian Data Protection Inspectorate
pursuant to the Administrative Procedure Act1, or
- An appeal to an administrative court under the Code of Administrative Court Procedure2
(in this case, the challenge in the same matter can no longer be reviewed).
Respectfully
Lawyer
Authorised by the Director General
1
https://www.riigiteataja.ee/en/eli/527032019002/consolide
2
https://www.riigiteataja.ee/en/eli/512122019007/consolide
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235