1(1)
Our ref.:
134935 Complaint concerning H&M
Date:
2022-01-25
Regarding the complaint against H&M in IMI case register no 134935,
national reference no 5.15-0544-025/017-19/191 in the case lodged with
the German SA (Niedersachsen).
Background
The complaint states that H&M had placed another customers list of order
in the complainant’s received package. Thus the complainant could see
another customer’s first and last name, full address (street, house number,
postcode, city, country) order number and date, email address and
payment method (Paypal). The complainant argues that by knowing that
the payment method is Paypal - including knowledge of the email address
- which is a part of the login process, the complainant could possibly get
access to the email account with the help of the other data and thus reset
the password securely at Paypal which also gives the complainant access
to Paypal directly from this point of view. The complainant finally argues
that the list of order also contains a detailed list of another customer’s
order, including underwear which the complainant consider to be highly
questionable. Not the clothes themselves, but the situation could be really
unpleasant for the concerned customer unknown to the complainant.
Finding
The Swedish Data Protection Authority (DPA) finds that the alleged data
protection violations does not involve actual processing of the
complainant’s personal data. Since it does not involve the processing of
the complainant’s data, it is not an actual complaint pursuant to article 77
of the GDPR that require the Swedish DPA to investigate the subject
matter to the extent appropriate pursuant to article 57(1)(f). However, the
information provided will be used in the Swedish DPAs general planning of
future supervision.
Postal address: With this informational letter the case will hereby be closed.
Box 8114
104 20 Stockholm
Sweden
Website:
www.imy.se
E-mail:
[email protected]
Telephone:
+46 (8) 657 61 00