Kamuya Açık Kimlik Numarası İddiası

EDPBI:SK:OSS:D:2022:377 — SK SA final decision (Article 15 (Right of access by the data subject), Article 17 (Right to erasure (‘right to be forgotten’)))

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

National No. 00211/2022-Os-3 (prev. 00499/2021-Os-7)

IMI Art.56: 178247

Case register no. 187706

In Bratislava, Slovakia

06.06.2022

# Official record

to postpone the complaint pursuant to Sec. 100 (5) of the Act no. 18/2018 Coll. on Personal Data Protection and amending and supplementing certain Acts (hereinafter as „Slovak Data Protection Act“)

On February 2, 2021 the Lithuanian Supervisory Authority (State Data Protection Inspectorate) (hereinafter as “Lithuanian SA“) contacted the Office for Personal Data Protection of the Slovak Republic (hereinafter as “Slovak SA”) via the internal IMI system (Art. 56, no. 178247 - identification of LSA and CSA procedure ).

Lithuanian SA received a complaint from (hereinafter as „complainant“) against the controller established in Slovakia: JOO INTERNET MEDIA LTD, organizačná zložka, Tallerova 4, 811 02 Bratislava, company registered no. 47 079 932 (hereinafter as „controller“). The complainant claims that the controller makes complainant’s personal identification number publicly available on its website www.joolist.eu.

After the examining the case, the Slovak SA decided on the basis of the provisions of Sec. 100 (5) (a) of Slovak Data Protection Act to p o s t p o n e the complaint (no. 00211/2022-Os, prev.00499/2021-Os, IMI no A56 178247, Case register 102666).

# REASONING

On February 2, 2021, the Lithuanian Supervisory Authority contacted Slovak SA via the internal IMI system (Art. 56, no. 178247 - identification of LSA and CSA procedure).

Lithuanian SA received a complaint from the complainant against the controller established in Slovakia. The complainant claims that the controller makes complainant’s personal identification number publicly available on its website www.joolist.eu.

The complainant in his complaint states that when the name and surname, i.e.

, is entered in Google search engine, the personal identification number of the complainant is publicly available on controller’s website.

The Lituanian Supervisory Authority asked the Slovak SA due to March 4, 2021 to state whether the Slovak SA would act as LSA in this matter in question. After a preliminary vetting of the complaint, the Slovak SA stated that the controller states on the website www.joolist.eu that it has its main establishment in the United Kingdom (Suite 126 Higham Hill JSC, 313 Billet road, E17 5PX London), but its main place of business is in the Slovak Republic. Based on the information available Slovak SA has assumed its role as LSA.

In the complaint, the complainant stated that he had evidence of the disclosure of his data, but this evidence was not submitted through IMI. Slovak SA was also unable to determine

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

the scope of the objected data, as the complainant objected disclosure of the “Personal identification number”.

Therefore, before the confirmation of the Slovak SA’s role as LSA, the Slovak SA requested the Lithuanian SA to provide the evidence mentioned by the complainant in his complaint and to specify what the complainant means by “personal identification number”. On March 8, 2021, the Lithuanian Supervisory Authority attached the required information with a link to the website https://www.joolist.eu/ as well as the screenshot of the Google search engine. After examining the evidence, the Slovak SA confirmed to act as LSA and created Case register no. 187706.

The Slovak SA requested the controller for cooperation, in particular to indicate whether it processes the complainant’s personal data and if so, to what extent, for what purpose and on what legal basis data is processes; to indicate whether the controller has published the identity of the complainant on the website www.joolist.eu and if so, what is the legal basis and purpose of such publication. Slovak SA also asked the controller whether the controller was contacted by the complainant with a request to erasure his personal identification number and if so, to provide the evidence and, if the controller has dealt with the request to provide the evidence for doing so as well.

The controller answered, quote (unofficial translation): “Our company does not process the complainant’s personal data in the databases but registers this data as the name of the company. We register 1 job offer, which is publicly available in five languages. We obtained this job offer from freely available gateways provided by the regional employment offices in each country in the European Union, which are part of and provide this data to the European Job Mobility Portal EURES. Our company does not process personal data (in English “personal identification number”) of the complainant in its databases, but we register the name of the company in the section Employer as a job offer looking for hostesses, mannequins. We were not contacted by complainant via the email address [email protected] or [email protected] (https://www.joolist.eu/sk-sk/osobne-udaje-gdpr/privacypolicy). Complainant with request to erasure the complainant’ data did not contact us in our profile via the Facebook, to which our website is linked with. Complainant with request to erasure the complainant’ data did not contact us via our web form on www.jooteam.eu, which is linked to the website www.joolist.eu. We were not contacted by Google Search Console to delete the links in the search engine. We deleted this job offer and requested the Google Search Console to erasure the searching index.”

Pursuant to Recital 14 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter as „GDPR“), the protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data, which concerns legal persons, and in particular, undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

Pursuant to Art 4 (7) GDPR, for the purposes of this Regulation: 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Pursuant to Art. 4 (23) GDPR, for the purposes of this Regulation: 'cross-border processing' means either:

(a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

Pursuant to Art. 15 GDPR, the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the data subject, any available information as to their source;
(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Pursuant to Art. 17 GDPR, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Pursuant to Art 56 (1) GDPR, without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.

Pursuant to Art 56 (2) GDPR, by derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.

The purpose of personal data protection proceeding in Slovak Republic (hereafter as "proceeding") is to determine whether there was any infringement of the rights of natural persons when their personal data were processed or if there was any violation to this Act or GDPR in the area of personal data protection; and, if any deficiencies are identified, if it is reasonable and useful, to impose corrective measures or impose a fine for violation of this Act or GDPR.

Pursuant to Sec. 100 (1) of the Slovak Data Protection Act, the proceeding is initiated based on the complaint of a data subject that claims that his or her rights lay down by this Act are directly influenced (hereafter as "the complainant"), or without a complaint.

Pursuant to Sec. 100 (5) (a) of the Slovak Data Protection Act, (5) The Office shall postpone the complaint if the complaint is manifestly unfounded.

The controller declared to the Slovak SA that the controller does not process any data of the complainant in its databases, but the controller registered the complainant as the legal person in the Employer's section. The controller further stated that complainant did not contact him to erasure the complainant's data. The controller deleted the publicly available job offer together with the data that had been published on www.joolist.eu. The controller also requested the Google Search Console to erasure the searching index for the name

The Slovak SA verified the abovementioned statements of the controller on September 24, 2021. The findings of the Slovak SA are: on the website https://www.joolist.eu/, there is no data of the complainant publicly available, the name and surname of the complainant in connection with the website www.joolist.eu is not publicly available in Google search engine either.

ÚRAD NA OCHRANU
OSOBNÝCH ÚDAJOV
SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

On the basis of abovementioned findings, the Slovak SA decided to postponed the complaint pursuant to Sec. 100 (5) (a) of the Slovak Data Protection Act without launching an administrative proceeding.

Should new relevant facts be identified, the matter could be reviewed in the personal data protection proceedings.

Head of the Department
of administrative proceedings
Office for Personal Data Protection
of the Slovak Republic

Kamuya Açık Kimlik Numarası İddiası

Türkçe özet

Hukuki mesele

Sonuç

Karar metni