[Navn 1] [Navn 2] XX.XX.XXXX
[Adresse 1] [Adresse 2] [Adresse 3]
[Postnr.] [Postdistrikt] J.No. 2020-7320-1827
Doc.no. 478508
[Landenavn]
Caseworker
Rasmus Martens
Complaint about processing of personal data The Danish Data
Protection Agency
1. The Danish Data Protection Agency (Danish DPA) returns to the case, where you on 10 Carl Jacobsens Vej 35
February 2020 have complained to the Berliner Beauftragte für Datenschutz und Infor- 2500 Valby
Denmark
mationsfreiheit (DPA, Berlin) about Trustpilot A/S’ response to your request for access.
T 3319 3200
[email protected]
In accordance with Article 56 of the General Data Protection Regulation, the Data Protection datatilsynet.dk
Agency has been designated as the lead supervisory authority in relation to Trustpilot A/S. VAT No. 11883729
2. Facts of the case
It is apparent from the file that on 11 May 2019 you made an online purchase of an item from
the company Asus on Ebay’s website. The e-mail you provided in connection with the purchase
from Asus was [email protected].
On 3 February 2020, you received an email from [email protected] to your
address [email protected], where Asus Online Shop appeared as the sender. You were asked
in the email to evaluate the buying experience at Asus.
On 4 February 2020, you contacted Trustpilot from another email address (service@le-
varia.de) and requested access to the personal data Trustpilot may process about you. In
addition to the e-mail address, the inquiry included your name and address.
Trustpilot replied on 6 February 2020 and stated that Trustpilot could not locate an active user
for the email [email protected] and that Trustpilot therefore did not process any information
about you.
On 8 February 2020, you again received an email from [email protected] on
behalf of the Asus Online Shop sent to [email protected], in which you were again asked to
evaluate your purchase from Asus.
You subsequently complained on 10 February 2020 about Trustpilot’s response to your re-
quest for access to the German supervisory authority (Bavaria DPA), which forwarded the
complaint to the Berlin supervisory authority.
As the lead supervisory authority in relation to Trustpilot, the Danish Data Protection Agency
subsequently took over the case from the Berlin supervisory authority, after which on 14 July
2020 the Danish Data Protection Agency sent your complaint to Trustpilot and asked Trustpilot
for a statement on the case.
Page 2 of 4
Trustpilot issued a statement on the matter on 19 August 2020. The statement was sent to you
on 8 September 2020.
The Berlin supervisory authority informed the Danish Data Protection Agency on 12 January
2021 that you had not commented on the statement.
On 10 September 2021, the Danish Data Protection Agency asked Trustpilot for an additional
statement on the case, which Trustpilot submitted on 1 November 2021 as regards to the role
of Trustpilot when sending invitation emails.
At meetings between Trustpilot and the Danish Data Protection Agency on 25 February and 9
March 2022, Trustpilot explained the company’s ability to identify data subjects in general and
how Trustpilot in the case in question had tried to uniquely identify you.
2.1. Your comments
You have generally stated that Trustpilot is not allowed to process information about you and
that Trustpilot has not responded to your request for access in accordance with the data pro-
tection rules
2.2. Comments from Trustpilot
Trustpilot has generally explained that Trustpilot is an open platform where everyone can read,
write and collect reviews. Customers can rate a company at any time, and companies with an
online presence can — independently or with Trustpilot’s help — invite customers to rate the
company.
Trustpilot has further explained that Trustpilot is the data controller for information collected
when data subjects use Trustpilot’s website, create user profiles, or submit and/or respond to
reviews.
However, Trustpilot considers itself a data processor in relation to sending invitation emails.
This is based, among other things, on the fact that companies, such as Asus Online Shop,
assess whether or not they want to use Trustpilot’s invitation software, just as the companies
decide whether and when invitations are sent out via Trustpilot’s invitation software. In addi-
tion, it is the companies that provide the personal data used in connection with the invitations.
Trustpilot has stated in relation to your complaint that Trustpilot neither as a data controller nor
as a data processor processes personal data associated with the email address ser-vice@le-
varia.de. Trustpilot processes information associated with the email address [email protected]
as data processor for Asus Online Shop. As this email was not used or disclosed in connection
with the access request, Trustpilot could not conduct a search in Trustpilot’s systems based
on the enquiry. If the email address [email protected] had been provided, Trustpilot would have
referred you to the Asus Online Shop, which Trustpilot processed the personal data about you
on behalf of.
Trustpilot explained in detail that Trustpilot did a search on the e-mail [email protected], the
first and second time you contacted Trustpilot, and that Trustpilot could not identify you on that
basis, as Trustpilot had not registered the email [email protected].
When Trustpilot became aware of your complaint, Trustpilot also conducted a search by your
name. As a result, Trustpilot found that Trustpilot could not uniquely identify you when search-
ing your name (either alone or in conjunction with the e-mail [email protected]), as Trustpilot
has several registered names with the same name as you.
Page 3 of 4
Trustpilot states, however, that on the basis of the present case, the company has rethought
Trustpilot’s communications, so that Trustpilot — when communicating with data subjects —
has even more focus on providing guidance on Trustpilot’s different roles in the processing of
personal data.
3. The Data Protection Agency’s assessment
According to Article 4(7) of the GDPR, the controller is a natural or legal person, public author-
ity, agency or other body which alone or jointly with others determines the purposes and means
of the processing of personal data.
Furthermore, Article 4(8) of the Regulation provides that a ‘processor’ means a natural or legal
person, public authority, institution or other body which processes personal data on behalf of
the controller.
Article 15 of the GDPR provides that the data subject has the right to obtain confirmation from
the controller as to whether personal data relating to him or her are being processed and,
where applicable, access to the personal data and the information referred to in points (a) to
(h) of paragraph 1 of that provision. It is thus the responsibility of the controller that a request
for access by a data subject is handled in accordance with Article 15 of the GDPR.
Based on the information in the case, the Danish Data Protection Agency assumes that
Trustpilot, when sending the notification invitation on behalf of Asus Online Shop, processed
information about you as a data processor for the Asus Online Shop.
On the basis of the facts of the case, the Danish Data Protection Agency therefore does not
consider it necessary to override Trustpilot’s assessment that the company acts as a data
processor in connection with the sending of notification invitations.
As pursuant to Articles 12 and 15 it is not the responsibility of the processor, but the data
controller, to handle and respond to a request for access, the Danish Data Protection Agency
considers that Trustpilot has not acted in breach of these provisions.
However, from paragraphs 20 and 21 of Trustpilot’s Data Processing Agreement:
“Trustpilot A/S will promptly assist you with the handling of any requests from
data subjects under Chapter III of the GDPR and, where commercially practica-
ble, under any other Applicable Data Protection Law, including requests for ac-
cess, rectification, blocking or deletion, which relates to our processing of the
Relevant Data.
If Trustpilot A/S receives such a request, Trustpilot A/S will not respond to it other
than to inform the requesting data subject:
whether a review invitation email has been sent to the data subject on
your behalf; and
that he/she should submit his/her request to you, given that you will be
responsible for responding to these requests.”
The Danish Data Protection Agency finds it regrettable that, in a case such as the case,
Trustpilot did not have a consistent practice to search relevant information, including the name
and address, which the data subject had submitted in connection with his request under Article
15 of the GDPR, so that Trustpilot exhaustively explored the possibility of uniquely identifying
the data subject and thus, in its role as processor, could assist the controller to the extent Page 4 of 4
agreed in the data processing agreement.
This has been informed to Trustpilot by the Danish Data Protection Agency today.
4. Final remarks
The Danish Data Protection Agency notes that the supervisory authority’s decisions cannot
be brought before another administrative authority, cf. Section 30 of the Danish Data Protec-
tion Act. However, the Data Protection Agency’s decisions may be brought before the courts,
cf. section 63 of the Danish Constitution.
The Danish Data Protection Agency have sent a copy of this letter to Trustpilot. A/S.
The Danish Data Protection Agency hereby considers the case to be closed and won’t take
any further action in connection with the inquiry.
Kind regards
Rasmus Martens