FOR THE PROTECTION OF PRIVACY AND THE TRANSPARENCY OF THE STATE
Your: 22 December 2021
Member of the Management Board
Our: 27/06/2022 No. 2.1.-1/21/2432
Reprimand and notice of termination of proceedings in a personal data protection case
The Data Protection Inspectorate received a complaint from a Spanish
citizen (Appellant), via the Internal Market Information System (IMI), alleging that she was in
debt to (in the amount of 1,069.93 euros) and that it had been declared as a payment
default with the Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF).
According to the complaint, the Appellant has not been notified of the debt claim or of its entry
in the payment default register. The Appellant explains that she has sent a letter before claim to
by registered mail to the address of the company in Tallinn, but has not received a
reply.
In her letter before claim to the Appellant requested the following (unofficial
translation from the Spanish letter):
I hereby declare via this writ, that I have not received any communication or notification from
their side, indicating this fact.
Hence, I wish to request all the necessary documentation informing on the causes of the claim
and how the amount was generated, main amount, applied interests, commissions, etc. so that
I can check that they match the original signed contract, whose copy I also request. To this
respect, I want to point out that, in the formalisation of the original contract, I was not warned
about the possibility that my personal data could end up in an insolvency file, nor specification
of which of them. If I had availed of that data, I might have considered the formalisation of the
abovementioned contract.
I wish to indicate also that I perceive conditions that exceed what can be assumed as normal
conditions, due to the irregularities in the formalisation of the contract, the lack of the least
explanations about its functioning and its failing to pass the legibility standard intrinsic to this
kind of contracts before the consumers, seriously violating, moreover, the law regarding the
processing of my personal data.
For all the reasons exposed above, I REQUEST to receive the necessary documentation
showing the abovementioned ‘supra’, and until the matter is clarified, they abstain from
maintaining annotations linked to my personal data in any insolvency files and violating my
rights, as the current Data Protection Law establishes. Thus, I request the cautionary
cancellation of my data, while the compliance of the rules is under supervision. Likewise, due
to the double request sent to your entity, I beg that the Customer Service department forwards
copy of my pretension to the data protection department.
Based on the above, I have initiated supervision proceedings on the basis of clause 56 (3) 8) of
the Personal Data Protection Act.
Tatari 39 / 10134, Tallinn / 627 4135 / [email protected] / www.aki.ee Registry code 70004235
FOR THE PROTECTION OF PRIVACY AND THE TRANSPARENCY OF THE STATE
3. Are there any documents proving the payment default of the Appellant? Has the
Appellant received such documents?
The Appellant has received information about her debt from various sources:
1) from her portal account (it can be seen from the system that the Appellant
has logged in to her account after the payment default);
2) the notifications sent by (Annexes 3 to 5), which were also seen by the
Appellant (the emails were opened), and
3) the communication between the Appellant and the service provider (see the
answer to question 7). The Appellant was aware of the sources and documents related
to the notification of the payment default and has had the opportunity to inspect them.
4. How was the accuracy of the debt data checked before it was transferred to the register
of payment defaults?
verifies the accuracy of the debt data through a technical solution that notifies
the system of the outstanding loan amount on the due date. Verifiability is
ensured by checking the arrival of the payment deadline and the receipt of the loan
repayment from the bank account of
5. Has the Appellant been informed of the right to transfer data? How was she informed?
The Appellant was informed of the right to transfer data for the first time upon
concluding the Agreement. This right is provided in clause 13.1 of the Agreement.
6. Was the Appellant informed of the publication of the debt details in the register of
payment defaults? How and on what date? If you informed the Appellant, provide proof
of it.
The Appellant was informed of the right to transfer data for the first time upon
concluding the Agreement. repeatedly informed the Appellant via email before
sending notifications to the Spanish register of payment defaults (Annex 5 – notifications
sent on 4 September 2019, 4 October 2019, 8 October 2019, and 17 October 2019). We
added an extract from the database, the fourth column (Status) of which shows that the
Appellant has opened some of the notifications (Annex 3).
7. Why have you not replied to the letter before claim of the Appellant? If you did, please
send a copy of the answer to the Inspectorate as well.
First, we wish to specify the procedure and circumstances for dealing with requests for
information in the context of this complaint:
1) the Appellant sent a letter to regarding her indebtedness by post on 3 June
2021, which is also known to be the last letter from the Appellant to
2) uses an external partner, to communicate with its customers in
arrears, whose representative was contacted by the customer support of on 4
June 2021.
3) received confirmation from that the customer has been contacted
before 3 June 2021, the necessary information has been forwarded, and the customer is
aware of the debt data. In addition, confirmed that the customer would be
contacted in connection with the request submitted on 3 June 2021.
8. Did you restrict the processing of the personal data of the Appellant when she objected?
Tatari 39 / 10134, Tallinn / 627 4135 / [email protected] / www.aki.ee Registry code 70004235
FOR THE PROTECTION OF PRIVACY AND THE TRANSPARENCY OF THE STATE
For how long?
As has a legal basis for the transfer of data, the Appellant is still indebted to
to this day, and has repeatedly notified the customer of the right to
transfer the data in addition to the provisions of the Agreement, the customer has no
grounds to demand the restriction of the transmission of notifications related to the
payment default or the cancellation of the debt on the bases provided in the Agreement.
Clause 13.1 of the Agreement entered into with the customer also informs about the
possibility to submit a request for the deletion of data related to the debt to the respective
register of payment defaults. To our knowledge, no such request has been made at this
time and there are no active inquiries into the register of payment defaults.
attached to its reply a copy of the agreement concluded with the Appellant, the
principles of processing personal data at the notifications of to the
Appellant, and correspondence between and the service provider
regarding the request of the Appellant.
POSITION OF THE DATA PROTECTION INSPECTORATE
1. Lawfulness of the processing of personal data
In its reply, stated that it had transmitted the personal data of the Appellant to
ASNEF under Article 6 (1) (b) of the General Data Protection Regulation. The Data Protection
Inspectorate does not agree with this, as the transfer of the debt data of the Appellant to the
register of payment defaults is not an act that has to perform to fulfil its contract
with the Appellant. The legal basis for providing the debt data of the Appellant to a third party
can be derived from Article 6 (1) (f) of the General Data Protection Regulation, i.e. a legitimate
interest. Relying on this legal basis, the controller is obliged to carry out a detailed assessment
of the legitimate interest and to consider whether or not the processing of the data is permissible
in a particular case. If the assessment shows that the processing of the data is not permissible,
it must be stopped. Otherwise, the controller must prove to the data subject that there are
legitimate reasons to continue processing the data.
In addition, cannot rely on Estonian national law (the Personal Data Protection
Act) when transferring debt data, as Spanish law applies to the agreement in accordance with
the agreement (clause 16.1 of the agreement).
2. Release of personal data
On 21 April 2021, the Appellant sent a request to to issue to her all the necessary
documents regarding the debt, including the agreement concluded between the Appellant and
, and documents regarding how the principal debt, interest, service fees, etc. have
arisen. received the letter of the Appellant by post on 3 June 2021. A person
requesting documents or, for example, a citation of contract clauses goes beyond the scope of
the General Data Protection Regulation. However, a person may request a copy of the personal
data collected about them pursuant to Article 15 (1) and (3) of the General Data Protection
Regulation, in which case it is not prohibited for a copy of personal data to be issued as a copy
of a document. An entry or extract from a database that reflects, inter alia, the name of the
person, the components of the claim against them (principal, interest, recovery costs, etc.)
constitutes personal data, and is thus within the scope of the General Data Protection
Regulation.
In accordance with recital 59 of the General Data Protection Regulation, the controller should
Tatari 39 / 10134, Tallinn / 627 4135 / [email protected] / www.aki.ee Registry code 70004235
FOR THE PROTECTION OF PRIVACY AND THE TRANSPARENCY OF THE STATE
be obliged to respond to requests from the data subject without undue delay and at the latest
within one month and to give reasons where the controller does not intend to comply with any
such requests. Article 12 (3) of the General Data Protection Regulation lays down the same
deadline for replying to the request of the Appellant. In its reply, explained that it uses
an external partner, to communicate with its customers in arrears, whose
representative was contacted by the customer support of on 4 June 2021.
received confirmation from that the customer has been contacted before 3 June 2021,
the necessary information has been forwarded, and the customer is aware of the debt data.
The Data Protection Inspectorate finds that the conduct of was not lawful because,
pursuant to Article 12 (3) of the General Data Protection Regulation, as the controller
was obliged to reply to the Appellant within one month or to provide reasons for not providing
the Appellant with the requested documents and/or information (see recital 59 and
Article 12 (4) of the General Data Protection Regulation), even if the claim of the Appellant
falls outside the scope of the General Data Protection Regulation. Therefore,
should have provided the Appellant with a copy of the personal data she had requested (if the
Appellant had requested it) or explained in its reply why this was not done or, if the Appellant
had requested specific documents, should have justified why it was not possible
to submit the documents on the basis of Article 15 of the General Data Protection Regulation.
However, the allegation of the Appellant that she had not been informed of the debt or of its
transfer to the register of payment defaults is also irrelevant. has attached to its
letter copies of emails and extracts from its database, which show that reminders (both via text
message and email) of the debt have been sent to the Appellant on a regular basis (from 13
August 2019 to the present day) and she has also been informed that in case of non-payment of
the debt, has the right to submit the debt data to the register of payment defaults.
This possibility was also provided for in the agreement between the Appellant and
I would like to explain that it is obligation of the controller to make sure that data is being
processed in compliance with the General Data Protection Regulation. However,
disregarded the request of the Appellant to provide her with documents relating to her debt and
did not explain to the Appellant why it could not do so. In view of the above,
violated the requirements set out in the General Data Protection Regulation. However, based
on the fact that the Appellant received the information requested by her from her portal account
(it can be seen from the system that the Appellant has logged in to her account after
the payment default) and also provided her with information about the debt, I
reprimand on the basis of Article 58 (2) (b) of the General Data Protection
Regulation and draw attention to the following:
1. the legal basis for the transmission of debt data to a register of payment defaults is the
existence of a legitimate interest (Article 6 (1) (f) of the General Data Protection
Regulation).
is obliged to carry out a detailed assessment of the legitimate interest and
to consider whether or not the processing of the data is permissible in every particular
case. If the assessment shows that the processing of the data is not permissible, it must
be stopped. Otherwise, the controller must prove to the data subject that there are
legitimate reasons to continue processing the data.
2. The controller must take appropriate measures to provide the data subject with the
information referred to in Articles 13 and 14 and to inform them of the processing of
Tatari 39 / 10134, Tallinn / 627 4135 / [email protected] / www.aki.ee Registry code 70004235
FOR THE PROTECTION OF PRIVACY AND THE TRANSPARENCY OF THE STATE
personal data in accordance with Articles 15 to 22 and 34 in a concise, clear,
comprehensible, and easily accessible form using clear and simple language. This
information is provided in writing or by other means, including, where appropriate,
electronically. When requested by the data subject, the information may be provided
orally, provided that the identity of the data subject is proven by other means
(Article 12 (1) of the General Data Protection Regulation).
3. The controller has the obligation to submit a copy of the personal data concerning the
data subject at the request of the data subject (Article 15 (3) of the General Data
Protection Regulation).
If the data subject wants personal data about themselves, must do
everything in its power to ensure that all personal data is released. If personal data is not
released, it must be made very clear which type of data and for what reason cannot be
released.
4. The controller shall provide information on action taken on a request under Articles 15
to 22 of the General Data Protection Regulation to the data subject without undue delay
and in any event within one month of receipt of the request. This period may be extended
by two months, if necessary, taking into account the complexity and volume of the
request. The controller shall inform the data subject of any such extension within one
month of receipt of the request, together with the reasons for the delay (Article 12 (3)
of the General Data Protection Regulation).
Thus, if a person requests a copy of personal data concerning them, the copy must be
provided within one month or, if justified, the deadline for replying may be extended
within that month. In accordance with the General Data Protection Regulation, the
maximum legal term for providing data can be three months.
5. If the controller does not take action on the request of the data subject, the controller
shall inform the data subject without delay and at the latest within one month of receipt
of the request of the reasons for not taking action and on the possibility of lodging a
complaint with a supervisory authority and seeking a judicial remedy (Article 12 (4) of
the General Data Protection Regulation).
Thus, if considers that it has reasonable grounds for not releasing data, this
must be justified to the data subject within one month.
In view of the above and the fact that the Appellant received the
information concerning her through the register of payment defaults (ASNEF) and
a cooperation partner of , I will terminate the supervision
proceedings.
I further note that in a situation where the improper practice of processing personal data in this
way continues, the Data Protection Inspectorate has the right to issue a precept to
(and, if necessary, impose a penalty payment) or hold the controller liable in a misdemeanour.
A legal person may be fined up to 20,000,000 euros or up to 4% of its total annual worldwide
turnover for the previous financial year, whichever is greater.
This decision can be disputed within 30 days by:
Tatari 39 / 10134, Tallinn / 627 4135 / [email protected] / www.aki.ee Registry code 70004235
FOR THE PROTECTION OF PRIVACY AND THE TRANSPARENCY OF THE STATE
- submitting a challenge to the Director General of the Data Protection Inspectorate pursuant to
the Administrative Procedure Act2 or
- filing a petition with an administrative court pursuant to the Code of Administrative Court
Procedure3 (in this case, any challenges submitted in the same case can no longer be processed).
Sincerely
/signed digitally/
lawyer
Authorised by the Director General
2
https://www riigiteataja.ee/en/eli/527032019002/consolide
3
https://www riigiteataja.ee/en/eli/512122019007/consolide
Tatari 39 / 10134, Tallinn / 627 4135 / [email protected] / www.aki.ee Registry code 70004235