INTERNAL USE ONLY
Authority of information: Data Protection
Inspectorate
Mark made: 18.02.2022
Access restriction applies to: 18.02.2097
Legal ground: AvTS § 35 lg 1 p 12
Final decision article 60
Data controller
Complainants , and
Reprimand in a personal data protection matter
Notice of termination of proceedings
1. Complaint of
1.1.On 4 November 2019, the Estonian data protection authority (the Data Protection
Inspectorate) received the complaint of through the IMI system,
which was submitted to the inspectorate by the Latvian data protection authority.
wanted to receive information on the data collected in regard to him,
including his contact data, location details, purposes of data processing, the processing
method used, where and how the personal data of the complainant is retained, and when
the data of the complainant was last changed. The Estonian DPA asked the Latvian DPA
for more information about the complaint several times.
2. The correspondence between the data controller and the data subject
2. In the course of the supervision proceedings, forwarded to the inspectorate the
emails of the complainant , his various requests, and the related
metadata.
2.1.The complainant contacted the data controller ( ) on 28 September
2018, using the email address and writing a complaint in Latvian. The
inspectorate is not aware of the contents of the requests, due to the requests being made
in Latvian.
2.2.It appears to the inspectorate that responded to the request of the complainant on
28 October 2018 and forwarded to the complainant the documents concerning the
complainant.
2.3.One of the emails does not open for the inspectorate. It appears, however, that itself
approached the complainant on 3 November 2018 – this correspondence also includes
’ own request. Once again, the content of the request is difficult to understand.
2.4.The complainant contacted again on 5 November 2018.
2.5. answered on 7 November 2018.
2.6.The complainant contacted on 30 November 2018. The complainant did not receive
a reply to this request.
2.7.The complainant contacted again on 2 January 2019.
Tatari 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / Registry code 70004235
2.8. replied to the complainant’s email on 2 January 2019.
2.9.The complainant contacted again on 9 May 2019. has not attached any other
documents concerning emails.
2.10. Additionally, has enclosed the complainant’s communication from 25 June
2019, which is in Latvian. The inspectorate is unable to understand to whom the
communication is addressed. The complainant has contacted someone also on 30 July
2019; there is a reference in the subject line to . The third PDF document
is entitled ‘ reply’ – presumably, this document includes the response of the data
controller to the complainant’s requests.
2.11. The inspectorate asked the Latvian supervisory authority for clarification twice
to understand what specifically the complainant requested; the inspectorate also asked
to translate the complaint in Latvian into English.
3. Inquiries of the inspectorate to
3. The inspectorate then sent an inquiry to the data controller on 8 April 2020.
3.1.The data controller replied on 5 June 2020, apologising for not responding to the inquiry
of the Data Protection inspectorate on time on 8 April 2020 and thanking for the
extension of the term.
3.2.The data controller confirmed that the user is identifiable by way of
the inquiries made to the Customer Service and the emails exchanged between the
complainant and the email address ( ).
3.3.To the knowledge of the data controller, does not currently have any
active user accounts. Regardless of ’s ability/inability to identify ,
it is therefore not feasible to change the complainant’s email address. Should
create a new account and request that it be linked to the aforementioned email
address, reserves the right to refuse such a request, as the
use of the word ‘ ’ in the email address may infringe ’s rights as the holder of a
registered trade mark, the name may be misleading because of its other components ,
and therefore, it is unjustified to accept the aforementioned request.
3.4.The data controller added that, for reasons of data security, their preference is for
customers to submit requests to close a user account and to transfer the collected data
via in-app messages. This way, it is ensured in the best possible way that the actual
owner of the user account is behind the request. For its part, does its best to grant
the requests received through other channels (email). This requires additional manual
work on the part of the customer support, which is open to human error due to the large
number of customers, especially if the customer uses several user accounts and more
than one channel to make different requests. The combination of the following actions
is likely to yield the best results: a) making the submission of data subjects’ requests
under the General Data Protection Regulation as simple, comprehensible, and
convenient as possible when using in-app messages; b) promoting the use of the app for
the above purpose among ’s customers, highlighting the advantages of the provided
channel and the disadvantages of the alternative channels.
3.5.The inspectorate forwarded a new inquiry to the data controller on 13 May 2020. The
inspectorate requested that the complainant be provided with all information concerning
2 (11)
the complainant, including the information that the complainant referred to. A request
was also made to submit to the inspectorate a copy of the reply to the complainant
together with the data file issued to the complainant.
3.6.The data controller replied on 26 May 2020 regarding the complaint made by
as follows:
3.7. was provided with data about them in CSV format on 28 October 2018.
The purposes of processing the data were described in 2018 (as is done currently in
’s Privacy Policy, available at ). The data retention response was
forwarded to on 7 November 2018 and the response log was sent in the
response dated 28 October 2018. Information about was appended as
an attachment to the reply given to the inspectorate.
4. Position of the Data Protection Inspectorate
4.1. The Estonian Data Protection Inspectorate finds that the data controller has
responded to the complaint and handed out information the complainant asked.
4.2. The data controller has cooperated with the inspectorate (provided detailed
responses to enquiries, forwarded the emails exchanged with
complainants, as well as metadata). Therefore, it would be reasonable to reprimand the
data controller in accordance with the GDPR and terminate the proceeding.
4.3. In regard to complaint , the complainant wished to receive
information on the data collected in regard to them, including their contact data, location
details, purposes of data processing, the processing method used, where and how the
personal data of the complainant is retained, and when the data of the complainant was
last changed. During the proceeding, the data controller has explained which data was
collected in regard to complainant and clarified that the email address of the
complainant cannot be changed to contain an email address referring to the data
controller, as this would entail a copyright infringement
4.4. The data controller explained that based on the data security considerations, it is
preferred that clients submit requests for deleting their user account or forwarding the
data collected via in-app messages. That way, it can be best ensured that the request is
indeed made by the actual holder of the user account. shall, in turn,
do its best to support the satisfaction of requests received via other channels (email) as
well.
4.5. The data controller has sent the metadata to the inspection and clarified that
’ user account has been deleted. The data controller said that it is necessary by
law and with legitimate interest to retain certain data, e.g. accounting documents.
4.6. The inspectorate finds that data processing could have been more transparent. At
the intervention of the inspectorate, the data controller provided more detailed and
specific answers to the complainant. This is why a reprimand is appropriate as a result
of the proceeding.
5. Decision of the inspectorate in the complaint of
5.1. The Estonian Data Protection Inspectorate finds that when processing personal data,
the controller shall ensure that the data is processed lawfully, fairly, and in a transparent
3 (11)
manner in relation to the data subject (Article 5 (1) a) of the General Data Protection
Regulation). cannot be held responsible for not changing the complainant’s email
address to – it might bring up copyright issues
because the email address refers to ‘ ’.
5.2. In addition, has to reply to data subjects in a more explained way, in the sense
that the data subject receives their answer in depth about what data has been collected,
how, when, and through what information channels. has to make the responses
more clear to the data subjects in general.
6. The Estonian Data Protection Inspectorate issues a reprimand to the data controller
under Article 58 (2) b) of the General Data Protection Regulation
and draws attention to the following:
6.1. When processing personal data, the controller shall ensure that the data is processed
lawfully, fairly, and in a transparent manner in relation to the data subject (Article 5 (1)
a) of the General Data Protection Regulation). It is also important that persons are not
provided misleading information concerning the processing of data (including the
deletion of data).
6.2. The data subject has a right to request the deletion of, for instance, an account as
well as other personal data concerning this person without undue delay. They also have
the right to demand this if there is no legal basis for the processing of data. The personal
data shall be deleted without delay pursuant to Article 17 of the General Data Protection
Regulation.
7. Complaint of
7.1. On 2 January 2020, the Estonian Data Protection Inspectorate received the complaint
of through the IMI system, which was submitted to the inspectorate
by the Polish data protection authority. The complainant had turned to the Polish data
protection authority on 25 June 2019.
7.2. According to the complaint, the citizen wanted to delete their user account and
personal data from the system. Prior to that, the complainant had wanted to receive
information collected about themselves. The complainant sent a letter to on 16 May
2019 requesting to delete their personal data. This letter was sent to the email
addresses , and . The complainant was
told by customer support that the deletion of data would take place through the
application. The complainant adds that by the time of contacting ’s Polish customer
support, the complainant had already deleted the application. The complainant wants to
see the data collected about the complainant.
8. The correspondence between the data controller and data subject
8.1. On 16 May 2019, the data subject wrote the following to the controller:
In accordance with the point “8.Deletion” of “Privacy for Passengers” and in the
article 17 of GDPR, I hereby request to permanently delete my account, I withdraw
all consents to the processing of any of my personal data and I request to delete all data
collected about me.
Beforehand, in accordance with the point “9. Portability” of “Privacy Policy for
Passengers” and relevant regulations of GDPR, please send to my e-mail aadress or via
another agreed channel all the data collected about me.
4 (11)
8.2. replied on 19 May 2019 that for the account to be deleted, the request must be
sent through the application (from ).
8.3. Somehow, there is a response on 16 of May 2019 from , which says, “We are
currently struggling with a significant number of incoming reports; out responses can
therefore reach you later than usual.” (It might be an automatic response).
8.4. On 19 May 2019, the data subject sent an email to , saying the following:
I’m sorry, but you did not understand my request. You also did not check the exact status
of my account (I submitted a request to delete my account in the application already on
16 May, and especially for you, I just created an account and re-submitted a request to
delete it). Deleting the account is just one element of my request. I am waiting for the
next part to be completed.
First of all, you have not read or understood my previous message. Please read and
understand my request from 16 May 2019, in particular regarding the erasure of
collected data. Before that, I recommend you familiarize with your own Privacy Policy
and provisions of GDPR.
In the event of failing to fulfil its statutory obligation, the matter will be reffered to
the President of UODO (Personal Data Protection Office). Let me remind you that a
fine up to EUR 20 million and up to 4% of the total annual turnover of the preceding
financial year may be imposed for breaching the provisions of the GDPR.
Please treat my request from the previous email carefully, seriously and consider it with
due diligence.
8.5. On 21 May 2019, the data subject once again wrote to the data controller:
Mrs ,
I assure you that I got acquinted with it. I see, however, that we do not understand each
other, therefore I want to end my correspondence with you at this point. I consider my
request still unsolved by the office in Warsaw.
I inform you that I will await for a response from competent individuals within your
organization (i.e Data Protection Officer at until June 16. All
messages in this correspondence were also sent to him and to customer support
( ).
In case of further evasion of the obligation imposed by the GDPR, on 17 June 2019, an
adequate letter will be sent to the UODO.
9. Inquiries of the inspectorate to
9.1. The inspectorate then sent an inquiry to the data processor on 8 April 2020. The
Polish complainant has contacted for clarification and deletion of the data, but they
are not satisfied with the answers provided. Polish national, , requests a copy
of the data collected about them and allegedly not sent to them by . The inspectorate
asked to forward all information and data collected on the Polish citizen,
. Additionally, the inspectorate requested to delete data that could be
deleted by in relation to and provide the inspectorate an explanation
regarding this (which data was deleted).
9.2. replied on 5 May 2020:
In answering this question, we ask the Data Protection Inspectorate to specify the details
of the transmission of the information and data collected (addressee, method and
channel of transmission, if the Data Protection Inspectorate has any preferences in this
regard). In particular, does the Data Protection Inspectorate: a) request that the
information and data be provided directly to or b) want the
information and data to be transmitted to an official designated by the Data Protection
5 (11)
Inspectorate, whose personal identification code could be used by to encrypt the
information and data transmitted? Please indicate the above preference for the
transmission of information and data no later than by 8 May 2020. In the absence of
input, will forward the collected information and data directly to
by email no later than 8 May 2020 and will share with the Data Protection Inspectorate
the email confirming the transmission.
9.3. We have clarified in our previous cooperation with the Data Protection Inspectorate
(see our answer to inquiry 2.1-1/19/1946 of the Data Protection Inspectorate) that the
deletion process includes the following actions: - the user is logged out of the application
(force logout); - first name and surname are deleted (fields are left blank); - the email
address is deleted (the field is cleared); - the telephone number is replaced by a sequence
of random numbers; all communication with the customer (especially the newsletter) is
prohibited; - the deletion command is transmitted to the associated systems
(communication platforms).
9.4. The user was identified through customer service inquiries and emails. Based on
these and ’s information system logs, the chronology of user-related actions is as
follows:
Account 1: 06.09.2018 – creation of the account (account_no: )
Account 1: 11.05.2019 – account deletion request (in-app request)
Account 1: 16.05.2019 – account is deleted, information is provided to the customer.
The customer does not notice the confirmation of account deletion.
Account 2: 19.05.2019 – a new request from the customer to delete the account is sent
by email and instructions for making an in-app request are sent to the user.
Account 2: 19.05.2019 – the customer creates a new account (account_no: )
and sends an in-app request for the new account to be deleted.
Account 2: 21.05.2019 – customer service sends an in-app confirmation message that
the account will be deleted within 30 days.
Account 2: 25.05.2019 – the new account is deleted. ’s inquiries were
answered, the deletion of accounts was performed more quickly than required under
Article 12 (3) of the General Data Protection Regulation.
In summary, the requests for deleting the in-app user account were granted on 16 May
2019 and 25 May 2019 – however, the request set out in point (ii) was difficult to comply
with and it was not fulfilled.
The following contributed to this result: a) the abundance of communication channels
and the customer’s statements of intent; b) the fact that ’s customer service may
have assumed that the scope of the customer’s later statement of intent (19 May 2019
in-app request) (delete only the user account) may take precedence over the scope of
the customer’s previous statement of intent (19 May 2019 email; deletion and prior
transmission of the data collected). A further analysis of the communication related to
this complaint indicates that the customer’s actual statement of intent included the
transmission of the data collected about them. Further internal investigation will allow
to fulfil the customer’s actual request, which we want to achieve no later than 8
May 2020, by forwarding the requested data to the email address of
9.5. The inspectorate forwarded a new inquiry to on 13 May 2020, requesting that
the inspectorate be provided with the information provided to in connection
with their complaint. At that point, a third complaint, by , came to the attention of
the inspectorate, and the inspectorate asked for clarification.
9.6. answered on 19 May 2020 forwarding the reply sent to on 8
May 2020. also included all the data that had collected on
6 (11)
Regulation and draws attention to the following:
12.1. When processing personal data, the controller shall ensure that the data is
processed lawfully, fairly, and in a transparent manner in relation to the data subject
(Article 5 (1) a) of the General Data Protection Regulation). It is also important that
persons are not provided misleading information concerning the processing of data
(including the deletion of data).
12.2. The data subject has a right to request the deletion of, for instance, an account as
well as other personal data concerning this person without undue delay. They also have
the right to demand this if there is no legal basis for the processing of data. The personal
data shall be deleted without delay pursuant to Article 17 of the General Data Protection
Regulation.
13. Complaint of
13.1. turned to the Polish data protection authority on 4 February
2019 to delete her account, but to do so, she was asked to provide a picture of
herself with an ID-card. In her initial complaint to Poland, the complainant wrote
that on 5 January 2019, she requested that delete her personal data. The
complainant has not specified whether she is driver or a customer. The complainant
wrote to the email address .
14. The correspondence between the data controller and data subject
14.1. The correspondence between the complainant and shows that on 5 January
2019, the complainant wrote that she wished to delete her account:
1.1.
5 January, 17:46 EET
I resign. Please erase my e-mail and phone number from your database.
5 January, 18:34 EET
Good morning,
Certainly, I will satisfy your request, however I would like to inquire what is the
reason for the resignation from our services? Are you certain you wish to delete
your account?
5 January, 18:42 EET
I am certain. The reason is the multitude of notifications about discount (SMS,
mail, app notifications).
5 January, 19:02 EET
The deletion of your phone number can be done only if your entire account will
be deleted. There is a possibility to only cancel the notifications, so they don’t
disturb you anymore. Therefore, what do you choose, cancellation of the
notifications or the deletion of the entire account?
5 January, 19:04 EET
What do you mean by ‘cancellation of notifications’?
8 (11)
5 January, 19:09 EET
Right now your setting regarding the receipt of notifications and messages is
turned on. I can turn it off, so that all the offers will be blocked. The only
messages you will receive would be the ones concerning the confirmations of
fares, which is required by law.
5 January, 19:12 EET
Ok. Please, delete my account.
6 January, 08:29 EET
Good morning,
Ok, I will get to it right away. The last thing I need to ask you is your clear
photograph with an ID card close to your face (all this data will be deleted with
the account) so that I can confirm your identity. It is necessary at this moment,
so that I can continue.
20.03.2019, the complainant further contacted the Polish data protection
authority, explaining that they did not know where to turn. They added the
address and contacts of the data controller, noting that the violation related to
their contact details.
15. Inquiries of the Inspectorate to
15.1. The Inspectorate sent an inquiry to the data controller on 13 May 2020 as to the
legal basis on which the complainant is obliged submit a picture of themselves together
with their ID-card to delete their account.
15.2. replied on 26 May 2020:
‘Pursuant to Article 12 (6) of the GDPR, where the data controller has reasonable doubts
concerning the identity of the natural person making the request, the controller may
request the provision of additional information necessary to confirm the identity of the
data subject. The legal basis for processing the image and the ID-card is the legitimate
interest of as the data controller. Providing a picture and ID-card helps to prevent
fraud and allows to identify the person requesting the deletion of the account. This will
also prevent a potentially more significant violation that would result from the deletion
of data at the request of the wrong person. However, prefers to receive the data
subject’s request for deletion through the application, which does not require additional
information. Additional information in the form of a picture and ID-card is required only
if identification inside the application is unsuccessful.
’s account has been deleted as at 22 October 2019.”
16. Position of the Data Protection Inspectorate
16.1. The Estonian Data Protection Inspectorate finds that the data controller has
responded to the complainant and cooperated with the inspectorate (provided detailed
responses to enquiries, forwarded the emails exchanged with
complainants, as well as metadata). Therefore, it would be reasonable to reprimand the
data controller in accordance with the GDPR and terminate proceedings regarding the
9 (11)
complainant.
16.2. The data controller explained that based on the data security considerations, it is
preferred that clients submit requests for deleting their user account or forwarding the
data collected via in-app messages. That way, it can be best ensured that the request is
indeed made by the actual holder of the user account. shall, in turn,
do its best to support satisfaction of requests received via other channels (email) as well.
16.3. The account of has been deleted, so the breach has been eliminated.
16.4. The inspectorate finds that data processing could have been more transparent. At
the intervention of the inspectorate, the data controller provided more detailed and
specific answers to the complainant. The data controller should have been clearer about
the fact why and on what legal grounds it is necessary to present an ID-card. Therefore,
a reprimand to the data controller is needed. This is why a reprimand is appropriate as
a result of the proceeding.
The complaints have indicated that if the data subject take s the necessary steps
inside the application to express their will, be it to access the data collected, close
the account, or make any other request, communication between the data subject
and will then function better. The abundance of communication channels has
created communication problems. It is also more difficult to identify the user and
their identity when the communication takes place outside the application.
Therefore, it is reasonable for to direct customers with an account to make
their declarations of intent through the application.
17. Decision concerning complaint
17.1. Concerning ’s complaint, The Estonian Data Protection
Inspectorate finds that has the right to ask for the ID-card pursuant to Article 12 (6)
of the GDPR. has made clear that without prejudice to Article 11, where the
controller has reasonable doubts concerning the identity of the natural person making
the request referred to in Articles 15 to 21, the controller may request the provision of
additional information necessary to confirm the identity of the data subject.
17.2. The data controller also has made clear that it does not ask for an ID-card when
the inquiries are made in the application and are completed successfully. An ID-card is
requested when the inquiries in the application have failed. only asked for the ID-
card to protect sensitive information collected about the complainant. The data
controller had to make sure that the person asking information is really the real user.
The data controller has made an effort to protect the data. However, the data controller
has to explain exactly why and on what legal grounds the ID-card is being asked.
18. The Estonian Data Protection Inspectorate issues a reprimand to the data controller
under Article 58 (2) b) of the General Data Protection Regulation
and draws attention to the following:
18.2. When processing personal data, the controller shall ensure that the data is
processed lawfully, fairly, and in a transparent manner in relation to the data subject
(Article 5 (1) a) of the General Data Protection Regulation). It is also important that
persons are not provided misleading information concerning the processing of data
(including the deletion of data).
10 (11)
18.2. The data subject has a right to request the deletion of, for instance, an account as
well as other personal data concerning this person without undue delay. They also have
the right to demand this if there is no legal basis for the processing of data. The personal
data shall be deleted without delay pursuant to Article 17 of the General Data Protection
Regulation.
18.3. The controller is obligated to explain why certain documents are required from the
complainant (e.g. ). The data controller could have explained to the
complainant in more detail why and under what legal basis they requested them to
provide a copy of their ID-card. This could have prevented the submission of a
complaint to the supervisory authority.
In view of the above, we shall terminate the supervisory proceeding.
This decision may be challenged within 30 days by submitting one of the two:
- A challenge to the Director General of the Estonian Data Protection Inspectorate
pursuant to the Administrative Procedure Act1, or
- An appeal to an administrative court under the Code of Administrative Court Procedure 2
(in this case, the challenge in the same matter can no longer be reviewed).
Respectfully
Lawyer
Authorised by the Director General
1
https://www riigiteataja.ee/en/eli/527032019002/consolide
2
https://www riigiteataja.ee/en/eli/512122019007/consolide
11 (11)