Berlin DPA: 521.11398 / 632.208
Spanish DPA: E/04491/2019
Berlin Commissioner for
IMI CR: 72181 Data Protection and
DD 329643 Freedom of Information
Friedrichstr. 219
10969 Berlin
Final Decision
Visitors’ entrance:
Puttkamer Str. 16-18
Attorney at Law
The building is fully accessible to
[redacted] disabled members of the public.
Sieglindestraße 7
12159 Berlin Contact us
Phone: +49 (0)30 13889-0
Reprimand Fax: +49 (0)30 215 50 50
Your letter of 4 September 2020
Use our encrypted contact form
Our hearing of 21 June 2021 for registering data protection
complaints:
www.datenschutz-berlin.de/be-
schwerde.html
Dear [redacted], For all o her enquiries, please
send an e-mail to:
[email protected]
We hereby issue a reprimand to your client for a violation of the General
Data Protection Regulation (GDPR). Fingerprint of our
PGP-Key:
D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
Reasoning:
Office hours
Our decision is based on the following considerations:
Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
I. (or by appointment)
We have established the following facts:
How to find us
On 9 January 2019, the complainant sent an unsolicited application with
The underground line U6 to
her CV to [email protected]. On the same day, as well as on 15 January Kochstraße / Bus number M29
2019, she received an email from [Person 1] informing her that she had re- and 248
ceived the complainant's application for the company CLBS in Thailand.
She did not reply as she assumed they were fraudulent emails. The com- Visit our Website
plainant then received a call from [Person 1] on 21 January 2019. [Person https://privacy.de
1] advised that she had received the data from the unsolicited application to
secretaria.es. On 21 January 2019, the complainant therefore sent an email
to [email protected] requesting access to her data and its eras-
ure. The complainant did not receive a reply.
The email address [email protected] is the general contact address of
Deutsche Bureau AG's customer service. Deutsche Bureau AG is a wholly-
owned subsidiary of ebuero AG, which is also based in Berlin, Germany.
Deutsche Bureau AG provides telephone secretarial and business centre
services for customers in several EU member states. This also includes
permanent activity on the Spanish market, where the company offers its
services under the domain secretaria.es as well as by means of Spanish
telephone numbers and Spanish-speaking employees. For this purpose,
Deutsche Bureau AG uses, among others, Chiangmai Lanna Business Ser-
vices Ltd. ("CLBS"). CLBS, which is based in Thailand, is also a wholly-
-2-
owned subsidiary of ebuero AG and operates for the other parts of the
group of companies on the basis of order processing agreements supple-
mented by EU standard contractual clauses.
Customer service requests to [email protected] are processed on behalf
of Deutsche Bureau AG by employees of CLBS as a processor. The com-
plainant's e-mail was therefore opened and processed by an employee of
CLBS. The employee forwarded the e-mail to the internal recruiting depart-
ment of CLBS. In doing so, he assumed that he was acting in the complain-
ant's interest. We were provided with a copy of the underlying data pro-
cessing agreement and the signed standard contractual clauses.
After the hearing was received by Deutsche Buero AG, CLBS employees
were once again instructed not to forward incoming applications and appli-
cation documents internally for recruiting purposes without the sender's
consent.
Deutsche Bureau AG has stated that the complainant's data has since
been erased. It was therefore no longer possible to establish whether the
request for information had been answered or whether the erasure had
been confirmed.
II.
Legally, we assess the facts of the case as follows: Your client has commit-
ted a violation of the General Data Protection Regulation (GDPR).
There has been a violation of Article 6(1) GDPR by Deutsche Bureau AG,
as there was no legal basis for the further processing of the application
documents. CLBS processed personal data on behalf of Deutsche Bureau
AG in accordance with Article 28 GDPR. Deutsche Bureau AG has con-
cluded a data processing agreement with CLBS for this purpose. Deutsche
Bureau AG remains responsible for the processing of the data. For the ex-
port of the data, the companies have concluded the standard contractual
clauses issued by the EU. The processing of personal data on the basis of
these contracts is permitted under the GDPR. Accordingly, an employee of
CLBS was allowed to receive the application documents. However, the
complainant applied to secretaria.es and thus directly to Deutsche Bureau
AG. Her documents should therefore have been forwarded only to the com-
petent persons at Deutsche Bureau AG. There is no legal basis for forward-
ing them within CLBS. The documents should not have been examined in
more detail there, nor should have been allowed to contact the
complainant by e-mail or telephone.
Furthermore, there is a violation of Articles 15(1), 17(1) and 12(1) and (3)
GDPR, as the erasure request of 21 January 2019 was not answered within
one month. It is true that the application documents have been erased in
the meantime. However, Deutsche Bureau AG should have responded to
the request within one month, which it did not do.
III.
As a result, we have decided not to take any further supervisory measures
due to the violation, but to leave it at a reprimand for the time being.
The reprimand is based on Article 58(2)(b) GDPR.
-3-
Taking into account the specific circumstances of the established facts, we
consider a reprimand to be appropriate after completing our investigation.
We have identified a violation on the part of your client for the first time.
When we approached your client, she was reasonable and once again in-
structed the employees of the processor not to forward application docu-
ments internally.
In the certain expectation that your client will comply with the data protec-
tion regulations in the future, we consider the matter closed.
Legal remedy
An action against this decision may be brought before the Berlin Adminis-
trative Court. It must be filed in writing - also as an electronic document us-
ing a qualified electronic signature (QES) - or with the clerk of the court
within one month of notification of this decision at the Berlin Administrative
Court, Kirchstraße 7, 10557 Berlin. It is pointed out that if the action is filed
in writing, the time limit for filing an action is only met if the action is re-
ceived by the Administrative Court within this time limit.
Kind regards,
[redacted]