Information and Data Protection Commissioner
CDP/IMI/LSA/01/2021
vs
COMPLAINT
1. On the 15th November 2020, (the “complainant”) lodged a complaint (the
“complaint”) with the supervisory authority of Austria (Österreichische Datenschutzbehörde,
the “Austrian SA”) against .1 (the “controller” or “ ”)
pursuant to article 77(1) of the General Data Protection Regulation2 (the “Regulation”).
2. By virtue of article 56 of the Regulation, the Austrian SA identified the Information and Data
Protection Commissioner (the “Commissioner”) as the lead supervisory authority competent
for the handling of the complaint. The Commissioner confirmed that it is indeed the lead
supervisory authority and proceeded to investigate the complaint on the basis of the procedure
set out in article 60 of the Regulation.
3. In his complaint, alleged that the controller had forwarded his personal data to another
, 3 ( “ ”), which consequently, used this
information to defend itself in judicial proceedings instituted by the complainant against
before the Austrian national courts.
1
is a private limited company incorporated in Malta and operating in the online gaming
sector with registration number and registered address at
2
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC.
3
is a private limited company incorporated in Malta and operating in the online gaming
sector with registration number and registered address at
Page 1 of 10
4. According to the complainant, the transfer of his personal data from the controller to
is not covered by the controller’s privacy policy 4 (the “Privacy Policy”). Furthermore,
the complainant argued that he had not given the controller the permission to transfer his
personal data.
5. Consequently, the complainant considered this processing activity constitutes an infringement
of the provisions of the Regulation, specifically articles 5 and 6 and, or 9 thereof.
6. As supporting documentation, the complainant provided a copy of an objection dated the 10th
August 2020 filed by with the District Court Fünfhaus, Austria, before which the
complainant had commenced judicial proceedings against under the European
Small Claims Procedure.
7. On pages 9 and 10 of such documentation, the defendant, , mentioned that the
complainant had previously opened a on the website
operated by the controller, and that he had subsequently requested a
based on the alleged illegality of ’ operations in Austria, which is the country
from where the complainant had placed his bets. In its objection, also provided
that had agreed to reimburse the amount demanded by the complainant out-of-court,
without accepting that his claim was legally grounded.
INVESTIGATION
8. The Commissioner requested the controller to provide its submissions on the allegation raised
by the complainant, and in particular: (a) a copy of the policy on the handling of the alleged
fraud cases; (b) a copy of the group organisational structure; (c) confirmation of the role of
in relation to the processing activity subject to the complaint; and (d) the legal
basis upon which relied to transfer the complainant’s personal data to .
In terms of this Office’s internal investigation procedure, the controller was provided with a
copy of the complaint, together with the supporting documents attached thereto.
4
, last seen on [….].
Page 2 of 10
9. The controller responded to the Commissioner’s request by submitting
group’s (the “group”) organisational structure as requested. Furthermore, the
controller indicated that both companies carry out their activities under the same group
corporate licence.
10. In its submissions, the controller also sustained that the group did not have any policy in place
to cater for transfers of personal data other than the compulsory procedures related to fraud,
anti-money laundering and . According to the controller, in certain
instances, such as when a customer initiates litigation against an entity pertaining to the group,
intra-group verifications are made to establish whether a is registered with other entities
pertaining to the group to protect its interests.
11. The controller also clarified that is part of the group and operates under the
corporate group licence, but it remains a controller on its own right.
12. The controller held that by registering as a customer of the complainant infringed
clause 5.13 of the terms and conditions which stipulates that the residents of any jurisdiction
where their participation would be in conflict with any applicable law or any other rules,
including those relating to , are prohibited from accessing or using the
website, app/s and games from such jurisdictions.
13. According to the controller, the fact that the complainant registered an account with
after having instituted legal proceedings against the controller in Austria alleging the
illegality of the controller’s services offer in Austria, constitute an illegal and fraudulent
activity on the part of the complainant.
14. In this regard, the controller mentioned that pursuant to recital 47 of the Regulation, the
prevention of fraud is an interest which is per se considered legitimate. The controller also
provided that it has a legitimate interest within the meaning of artic le 6(1)(f) of the Regulation
to use such information to protect the group in judicial proceedings, and that pursuant to the
same recital, such legitimate interest is extended to a controller to which the personal data may
be disclosed.
Page 3 of 10
15. Thereafter, through the Austrian SA, the Commissioner granted the complainant the right to be
heard by presenting the legal arguments of the controller. In this respect, the complainant was
provided with all the submissions provided until the date of the request for submissions.
16. The complainant refuted the arguments of the controller on the basis that his behaviour was
illegal or fraudulent, given that:
a. the controller never took any action against him in that regard;
b. the controller did not prevent him from opening a account with
and from placing therein;
c. the Austrian courts decided to dismiss his claim against for abuse of
rights and accordingly, the complainant stressed that in his opinion, abuse of right is
not fraud.
17. The complainant emphasised that the reason why he lost his lawsuit against was
the allegedly unlawful transfer of his personal data from to .
18. On a final note, the complainant held that the controller’s operations in Austria were illegal
because they were based on null and void contracts, and that he could not be expected to be
aware that formed part of the complex corporate structure of given that
this information was not mentioned in the Privacy Policy.
LEGAL ANALYSIS AND DECISION
19. As the first step of this legal analysis, the Commissioner sought to establish whether the
controller had indeed transferred personal data concerning the complainant to the third party,
.
In this regard, the Commissioner carefully examined the corporate group structure submitted
by the controller, and it was established that and are both subsidiaries
of and form part of the same group of companies. Additionally, the
Commissioner carried out the necessary verifications by consulting the Malta
Page 4 of 10
Authority’s licence register5 , and confirmed that the two (2) companies operate under the same
corporate licence. Notwithstanding this, it is imperative to emphasise that, for the purpose of
data protection legislation, the two (2) companies are deemed to be separate controllers.
20. After having examined the information used by in its objection filed before the
Austrian Courts, the Commissioner determined that the controller had in fact transferred certain
personal data pertaining to the complainant to . This was also implicitly
acknowledged by the controller in its submissions provided to the Commissioner during the
course of the investigation.
Lawfulness of the Processing
21. In this respect, the Commissioner notes that the principle of lawful processing, which is one of
the data protection principles, requires that every data processing operation has a lawful ground
for processing. In this regard, article 6(1) of the Regulation stipulates what may constitute such
a legal basis, taking also into consideration all the other core principles for processing personal
data as set out in article 5 of the Regulation.
22. The Commissioner therefore proceeded to examine article 6(1)(f) of the Regulation, which is
the legal basis invoked by the controller in relation to the transfer of the complainant’s personal
data to
23. Such provision provides that the processing shall be lawful as long as it “is necessary for the
purposes of the legitimate interests pursued by the controller or by a third party, except where
such interests are overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data […]” [emphasis has been added].
24. Within this context, the Commissioner examined the judgments 6, delivered by the Court of
Justice of the European Union (the “CJEU”), whereby it elaborated on the concept of the three-
part test and stated that “Article 7(f) of Directive 95/46 lays down three cumulative conditions
so that the processing of personal data is lawful, namely, first, the pursuit of a legitimate
interest by the data controller or by the third party or parties to whom the data are disclosed;
last accessed on 4th May 2022.
6 Rigas satiksme, C-13/16, paragraph 28 and T K v Asociaţia de Proprietari bloc M5A-ScaraA, Case C-708/18, paragraph 40.
Page 5 of 10
second, the need to process personal data for the purposes of the legitimate interests pursued;
and third, that the fundamental rights and freedoms of the person concerned by the data
protection do not take precedence.” [emphasis has been added].
25. In this respect, the Commissioner assessed the present case in the light of the three (3)
cumulative conditions as laid down by the CJEU. All the three (3) conditions identified by the
Court need to be present for the processing to be lawful: (i) the existence of a legitimate interest
justifying processing; (ii) the necessity of processing for the realisation of the legitimate
interest; and (iii) the prevalence of that interest over the rights and interests of the data subject,
which calls for balancing of interests.
26. First, the processing is conditional upon the existence of the legitimate interest of the controller
or of a third party. The Regulation does not define legitimate interest and thus, it is for the
controller to determine whether there is a legitimate aim that could justify an interference with
the right to the protection of personal data.
27. The Commissioner interprets “interest” to be the broader stake that a controller may have in
the processing, or the benefit that the controller or third parties may derive from such
processing. This interpretation is substantiated by the recitals of the Regulation, which provide
some non-exhaustive examples of situations in which legitimate interest could exist and this
could be processing for the purpose of preventing fraud, processing for direct marketing
purposes, the transmission of certain data within groups of companies and processing for the
purpose of ensuring network and information security. Furthermore, the case-law of the CJEU
held that transparency or the protection of the property, health and family life, are legitimate
interests 7 .
28. Additionally, the interest has to be “lawful”, which means that the interest pursued cannot go
against a legislative measure. In the present case, the legitimate interest at stake is that of a third
party, , specifically to defend itself in judicial proceedings instituted by the
complainant. Consequently, the third party which forms part of the same group as the controller,
exercised its fundamental right of defence, as enshrined in article 48 of the Charter of
Fundamental Rights of the European Union.
7
Volker and Markus Schecke and Eifert, Case C-92/09 and C-93/09, paragraph 77 & Rynes, Case C-212/13,
paragraph 34.
Page 6 of 10
29. It is hereby significant to underline that the Court of Justice of the European Union in the Rīgas
ruling held that “[a]s regards the condition relating to the pursuit of a legitimate interest, as
the Advocate General stated in points 65, 79 and 80 of his Opinion, there is no doubt that the
interest of a third party in obtaining the personal information of a person who damaged their
property in order to sue that person for damages can be qualified as a legitimate interest”8
[emphasis has been added].
30. The Commissioner highlights that there shall be a substantiated link between the processing
activity and the legitimate interest pursued by the third party concerned. In the case at present,
the Commissioner considered that the interest pursued by , to which the personal
data have been disclosed, is deemed to be sufficiently clear, articulated and specific.
31. In relation to the second condition, the Commissioner examined if the processing goes beyond
what is necessary, and therefore assessed if the processing activity was necessary for the
purpose of the attainment of the legitimate interests at issue.
32. The CJEU in its judgment Huber9 established that the condition of ‘necessity’ has its own
independent meaning, which shall reflect the spirit and scope of the data protection legislation.
Accordingly, the Commissioner notes that the principle of data minimisation as laid down in
article 5(1)(c) of the Regulation requires that the processing shall be adequate, relevant, and
limited to what is necessary in relation to the purpose of the processing. It therefore follows
that the processing of personal data shall be limited to what is plausibly necessary10 to pursue
a legitimate interest and therefore, there shall be a connection between the processing and the
interest pursued. For this purpose, any data that is not directly linked to obtaining, realising or
otherwise accomplishing the legitimate interests pursued is not lawfully processed.
8
Judgment of the Court (Second Chamber) of 4 May 2017, Valsts policijas Rīgas reģiona pārvaldes Kārtības
policijas pārvalde v Rīgas pašvaldības SIA ‘Rīgas satiksme, C-13/16, ECLI:EU:C:2017:336, para. 26.
9
Heinz Huber vs Bundesrepublik Deutschland CJEU C-524/06, 18 December 2008, para. 52.
10
Judgment of the European Court of Human Rights in case Silver & Others v United Kingdom of 25 March
1983, para 97 discussing the term 'necessary in a democratic society': “the adjective "necessary" is not
synonymous with "indispensable", neither has it the flexibility of such expressions as "admissible", "ordinary",
"useful", "reasonable" or "desirable" ….”
Page 7 of 10
33. After assessing the circumstances of the case, the Commissioner established that the processing
activity conducted by the controller was proportionate and adequately targeted to meet the
interests of the third party, specifically, the right of defence.
34. Finally, article 6(1)(f) of the Regulation calls for a balancing test, which requires that the
controller assesses whether the legitimate interest pursued by the third party is overridden by
the interests or fundamental rights and freedoms of the complainant. In this respect, account
shall be taken, inter alia, of the nature of the legitimate interest being pursued, the nature of the
personal data at issue, and the impact on the data subject. In relation to the latter point, the
Article 29 Working Party11 clarifies the purpose of article 6(1)(f) of the Regulation is not to
prevent any negative impact on the data subject, but to prevent any disproportionate impact. In
the case at present, the complainant contended that the Court rejected his claims against
as a result of the unlawful transfer of his personal data from to ,
however, the Commissioner could not consider this as a relevant consideration which tips in
favour of the complainant.
Information Obligation
35. Consequently, the Commissioner proceeded to examine the Privacy Policy available on the
controller’s website in order to establish whether the controller informed the data subject about
the possibility of sharing information with other companies forming part of the same group in
case of judicial proceedings instituted against one of the companies.
36. Accordingly, article 13(1)(b) of the Regulation states that controller shall, at the time when
personal data are obtained, provide “the purposes of the processing for which the personal data
are intended as well as the legal basis for the processing”. In addition, pursuant to article
13(1)(e) of the Regulation, the controller shall provide information in relation to “the recipients
or categories of recipients of the personal data, if any” [emphasis has been added].
37. Article 4(9) of the Regulation defines a “recipient” as “a natural or legal person, public
authority, agency or another body, to which the personal data are disclosed, whether a third
11
Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive
95/46/EC.
Page 8 of 10
party or not.” In this regard, the definition of “recipient” encompasses other controllers to
whom personal data have been disclosed by the controller.
38. After closely examining the Privacy Policy, particularly ‘Section 5 – Recipients of Your
Personal Data’, the Commissioner noted that the controller does not provide any information
in relation to the sharing of personal data among the group of companies for the purpose of
establishment, exercise or defence of a legal claim and for legal proceedings which may be
instituted under any law, as in fact was confirmed by the controller in its submissions provided
to the Commissioner.
On the basis of the foregoing considerations, the Commissioner hereby decides that:
a. the transfer of the complainant’s personal data by the controller to was
lawful on the basis of article 6(1)(f) of the Regulation; and
b. the controller infringed article 13(1)(c) and (e) of the Regulation, when it failed to provide
the complainant with information regarding the possible disclosure of his personal data
within the group of companies and the purpose of the processing for which the personal
data are intended as well as the legal basis for such processing.
By virtue of article 58(2)(b) of the Regulation, the controller is hereby being served with a
reprimand for having infringed the above-mentioned provisions.
Pursuant to article 58(2)(d) of the Regulation, the controller is hereby being ordered to amend
the Privacy Policy, by including the following information:
a. the recipients, or categories of recipients of the personal data;
b. the legal basis of the processing; and
c. the purpose of the processing.
This order shall be implemented within ten (10) days from the date of receipt of this legally-
binding decision and the controller is requested to inform the Commissioner with the action taken
to comply with such order immediately thereafter.
Page 9 of 10