THE COMMISSIONER FOR DATA PROTECTION AND FREEDOM OF INFORMA TION
LfDI Baden-Württemberg · P.O. Box 10 29 32 ·D-70025 Stuttgart
Date February 8, 2022
Name
Extension
via Datatilsynet
Our File No.
(please quote in all correspondence)
Final Decision pursuant to Article 60 (8) GDPR
Datatilsynet Reference: 20/03148-2
Preliminary comments
In June 2020, the Baden-Wuerttemberg Supervisory Authority (SA) received a com-
plaint (case no. ) against the controller about an alleged
unlawful processing of data in the form of a letter with a financial proposal. As the
controller is based in Norway, the Norwegian SA (“Datatilsynet”) acknowledged to act
as Lead Supervisory Authority (LSA) according to Article 56 (1) GDPR (IMI no.
132372).
In December 2021, Datatilsynet broadcast a Draft Decision (IMI no. 342391) to close
the case, since the complainant had not responded to the request about the disclo-
sure of his personal data to the controller, which makes it essentially impossible to
investigate the case further.
In order to comply with Article 60 (8) GDPR and to close the case, the Baden-
Wuerttemberg SA adopts the above-mentioned decision as originally prepared by the
Norwegian SA, as follows:
Lautenschlagerstraße 20 · D-70173 Stuttgart · Phone (+49) 711 615541-0 · Fax (+49) 711 615541-15 ·
[email protected] · [email protected]
www.baden-wuerttemberg.datenschutz.de · PGP Fingerprint: E4FA 428C B315 2248 83BB F6FB 0FC3 48A6 4A32 5962
For information on our privacy notice pursuant to Article 13 GDPR, please consult our webpage at the following address:
https://www.baden-wuerttemberg.datenschutz.de/datenschutz/
-2-
Decision
The Baden-Wuerttemberg State Commissioner for Data Protection and Freedom of
Information (hereinafter “LfDI BW”) adopts the following decision on the complaint
submitted against on 12 June 2020 (Case ):
The complaint shall be rejected pursuant to Article 60(8) of the General Data
Protection Regulation (GDPR).1
Factual Background
On 12 June 2020, the LfDI BW received a complaint against the Norwegian company
(hereinafter “ ”). The complainant claimed that
had processed his personal data without his consent, as he received a letter with
a financial proposal from without having consented to the use of his per-
sonal data for the sending of this kind of correspondence.
In his complaint, the complainant expressed the wish to remain anonymous towards
in the context of the handling of his complaint, and forbade the relevant
supervisory authorities from disclosing his name to .
On 19 June 2020, the LfDI BW shared the complaint with the other European super-
visory authorities through the IMI system. Thereafter, the Norwegian Data Protection
Authority (hereinafter “Datatilsynet”) was identified as the lead supervisory authority
in the case pursuant to Article 56(1) GDPR, and the LfDI BW and the French National
Data Protection Commission (hereinafter “CNIL”) were identified as the other supervi-
sory authorities concerned pursuant to Article 4(22) GDPR.
After having preformed a preliminary vetting of the complaint, on 7 September 2021,
Datatilsynet asked the LfDI BW to check with the complainant whether he would ac-
cept to withdraw his request for anonymity, as it would be essentially impossible to
expedite his complaint without disclosing his identity to .
On 5 October 2021, the LfDI BW wrote to the complainant to ask whether he agreed
to the disclosure of his name to . The LfDI BW requested the complainant
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection
of natural persons with regard to the processing of personal data and on the free movement of such data,
and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119/1.
-3-
to respond to the query within two weeks of reception. However, the complainant
never responded to the LfDI BW.
Legal Background
Pursuant to Article 57(1)(f) GDPR, each supervisory authority shall handle complaints
lodged by a data subject and investigate, to the extent appropriate, the subject matter
of the complaint.
To enable supervisory authorities to perform such a task, Article 58 GDPR entrusts
them with a number of investigative and corrective powers, including the power to re-
quest information from the relevant controller.
As noted by the EFTA Court in Joined Cases E-11/19 and E-12/19, Adpublisher, “the
supervisory authority’s exercise of its powers […] may necessitate disclosing the
identity of the complainants to the controller.” 2 Indeed, according to the Court, “the
effective functioning of data protection compliance under the GDPR may require dis-
closing the complainant’s personal data to the data controller. This would be the
case, inter alia, when the data subject, in accordance with point (c) of Article 58(2) of
the GDPR, requests to exercise his or her rights or alleges infringement of his or her
rights by the controller. Acting on this request, a supervisory authority may need to
disclose the identity of a complainant to the controller to enable the latter to fulfil the
order.”3 However, the Court found that “disclosing complainants’ identities may not
be necessary for the effective exercise of the right of defence where the investigation
or decision concerns standardised and equal data processing for an unspecified
number of data subjects, or where the investigation and decision is based on several
similar complaints.”4
Moreover, under Article 18 of the Norwegian Public Administration Act (forvaltnings-
loven),5 a company under administrative investigation has the right to access the
documents regarding the investigation that the relevant public authority holds (e.g., a
written complaint), unless there are special reasons to withhold access to a certain
document.
2
EFTA Court, Joined Cases E-11/19 and E-12/19, Adpublisher, judgment of 10 December 2020, para. 51.
3
Ibid.
4
Ibid., para. 52.
5
Lov 10. februar 1967 om behandlingsmåten i forvaltningssaker (forvaltningsloven).
-4-
Findings
The complaint at hand concerns a communication that allegedly sent to
the complainant to offer him to acquire a specific fund participation . Accord-
ing to the complainant, sent this communication without having obtained
his prior consent to the processing of his personal data for this purpose.
To expedite the complaint it would be necessary to disclose the identity of the com-
plainant to , to enable the company to share its views on whether it sent
the communication in question, and whether it had a lawful basis to do so under the
GDPR. This would be essential to ensure the effective exercise of the right of de-
fence of the company. Indeed, the complaint does not concern a standardised and
equal data processing for an unspecified number of data subjects; it concerns a one
off processing operation regarding a specific data subject. Moreover, should the ap-
propriate legal basis for the processing at hand be Article 6(1)(a) GDPR (consent) –
as the complainant seems to suggest – it would be basically impossible for
to confirm or deny whether it collected a valid consent without knowing the iden-
tity of the relevant data subject. Thus, the complainant’s request to remain anony-
mous towards makes it impossible to expedite the complaint.
Moreover, as a rule, a company under investigation in Norway has the right to get ac-
cess to the case file, which in this case would include the complaint mentioning the
name of the complainant.6 This rule may be waived only in exceptional circum-
stances. However, in the present case, Datatilsynet has not identified any special
reasons that would justify a waiver, in particular in light of the fact that the complain-
ant failed to provide any reasons why his name should not be disclosed to
.
In light of the above, the complaint shall be rejected pursuant to Article 60(8) GDPR.
The present case is therefore closed.
Right of Appeal
An appeal against this decision may be filed in writing, electronically or for recording
with the Administrative Court of Stuttgart, Augustenstraße 5, 70178 Stuttgart, within
6
Ibid., Art. 18.
-5-
one month of notification pursuant to Article 78 of the General Data Protection Regu-
lation in conjunction with Section 20(1) and (3) of the Federal Data Protection Act.