Veri Erişim Hakkı Şikayetinin Reddi

EDPBI:SK:OSS:D:2022:428 — SK SA final decision (Article 15 (Right of access by the data subject))

ÚRAD NA OCHRANU OSOBNÝCH ÚDAJOV SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

No. 01403/2021-Os-1 (previously 00418/2020-Os)

IMI Art.56: 87443

Case register no. 102666

In Bratislava, Slovakia

15.07.2022

# Official record

to dismiss the complaint pursuant to Sec. 100 (5) of the Act no. 18/2018 Coll. on Personal Data Protection and amending and supplementing certain Acts in wording of the Act no. 221/2019 Coll. (hereinafter referred as „Slovak Data Protection Act“)

On November 5, 2019 the Slovenian Supervisory Authority (Information Commissioner of the Republic of Slovenia) (hereinafter referred to as “Slovenian SA“) contacted the Office for Personal Data Protection of the Slovak Republic (hereinafter the “Slovak SA”) via the internal IMI system (Art. 56, IMI no. 87443 - identification of LSA and CSA procedure ).

Slovenian SA received a complaint from a Slovenian citizen – [REDACTED] (hereinafter referred as „[REDACTED]” or „data subject“) against FC ecom, s.r.o. Veľkomoravská 2866/9, 911 05 Trenčín, Slovakia, company registered no. 51 750 155 (hereinafter referred as „controller“ or „FC ecom, s.r.o.“), controller established in Slovakia. The complainant claims that he exercised his right of access [Article 15 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter as „GDPR“)], but the controller refused to act on the request of the data subject within one month.

After examining the case, the Office has come to the conclusion that the complaint is manifestly unfounded, and therefore on the basis of the provisions of Sec. 100 (5) (a) of Slovak Data Protection Act, the Slovak SA has decided to d i s m i s s the complaint [no. 01403/2021-Os-1 (previously 00418/2020-Os), IMI no. A56 87443, Case register 102666].

# REASONING

On November 5, 2019 the Slovenian Supervisory Authority contacted the Slovak SA via the internal IMI system (Art. 56, no. 87443 - identification of LSA and CSA procedure ). Slovenian SA received a complaint from a Slovenian citizen against FC ecom, s.r.o., controller established in Slovakia. The controller runs an online store that is also available in Slovenian language for Slovenian customers (https:// si.factcool.com). The complainant claims that he exercised his right of access (article 15 of the GDPR), but the controller refused to act on the request within one month. The controller replied to the request but it did not provide the complainant with any relevant information regarding the processing of his personal data nor did the controller refuse the request.

The complainant in his complaint stated, quote: „On 19.08.2019 I sent an e-mail to FACTCOOL S.R.O. to [email protected] requesting access to my personal data in accordance with Article 15 of the GDPR. I received the letter below dated 22.08.2019 which

ÚRAD NA OCHRANU OSOBNÝCH ÚDAJOV SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

I am forwarding to you. Their reply and the information provided is not in line with the GDPR, I insist that the company should inform me where it obtained my personal data. It is obvious that my personal data was exported to other countries without my knowledge. This is misuse of my personal data. The reply of the company has nothing to do with my request to Access personal data. I am asking the Information Commissioner of the Republic of Slovenia to consider my complaint as a priority. A also notified Agency for Communication Network and Services of the Republic of Slovenia and in the next few days I am planning to file a lawsuit with the Administrative Court of the Republic of Slovenia against the company. Because of that I ask you to consider the matter as a priority. If needed you should communicate with the Data Protection Authority of Slovakia as the company has its headquarters there."

The complainant exercised his right to access to his personal data on August 19, 2019 via e-mail address to the controller. The controller sent its reply on August 22, 2019 with the following, quote: „Factcool s.r.o. (Slovakia) sold Factcool.com online store to FC Ecom s.r.o. (Slovakia). Until 01.10.2018, Factcool s.r.o. only sold goods in Slovakia. In Slovenia, Factcool ltd from United Kingdom sold the Factcool.com online store. FC Ecom s.r.o. does not have any customer data from Factcool ltd. Factcool ltd owns the data. Attached to this email you will find a document about the sale of the company."

According to the findings of the Slovak SA, FC ecom s.r.o. operates an online store https://sk.factcool.com/. The online store exists in several language versions: Bulgarian, Bosnian, Croatian, Czech, Estonian, Greek, Hungarian, Italian, Latvian, Lithuanian, Polish, Romanian, Serbian, Slovenian and Slovak.

In its Privacy Policy, the controller states, quote: “FC ecom., With its registered office at Veľkomoravská 2866/9, Trenčín 911 05, IČO: 51 750 155, company registration number 36568 / R ("FACTCOOL" or "we") ensures the protection of personal data of its customers in accordance with the relevant legal provisions regarding data protection. This Privacy Policy describes how we collect, process and protect our Customers' personal data when browsing our Site and / or purchasing our Products.” Similar is also provided in the Slovenian language version of the controller’s Privacy Policy.

Since the controller has its single establishment in Slovak Republic, Slovak SA as LSA in this matter created Case register no. 102 666 in IMI system.

Slovak SA has requested FC ecom, s.r.o. in this matter for cooperation, in particular to indicate how the controller has dealt with the request of the data subject pursuant to Art. 15 of the GDPR and to provide an evidence to do so; whether the controller processes the personal data of the data subject and, if so, to what extent, for what purpose and on what legal basis the personal data are processed; what is the legal relationship between FC ecom, s.r.o. and Factcool Ltd. established in the United Kingdom regarding the processing of the personal data of the data subject

The controller answered, quote: „I’m sending you our written statement for this case with Mr. We as FC Ecom s.r.o. have purchased brand name Factcool from company Factcool s.r.o. with their assets. We have no relations with Factcool ltd. and we did not shifted any personal data from any foreign country. Our company is solely based in Slovakia and we operate in several countries within Europe as an eshop, within our general terms and

ÚRAD NA OCHRANU OSOBNÝCH ÚDAJOV SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

conditions, where we clearly state who we are, where we are based and under which rules we operate. Every customer is asked to accept it prior to the purchase. We take GDPR very seriously and upon request, we delete all information about customers except information required by law about accounting for the Tax Office of Slovak Republic. Mr. [REDACTED] has contacted us with a request of providing him information about his personal data with reference to Factcool ltd. After we checked our database, we have informed Mr. [REDACTED] that we have no data available about him what so ever in our database, and therefore have nothing to delete + we have no relations to Factcool ltd. After we informed Mr. [REDACTED] about this situation and sincerely apologized for this IT error that might have occurred, through our external marketing partner, who had send newsletters for us in the past. He requested that we will compensate him financially or materially for misusing his information." The controller refused to compensate complainant financially or materially. The company in its statement states that complainant has not provided the controller with any proof of misuse; the controller never received even the mentioned Newsletter that he apparently received from the controller.

The controller has attached screenshots from its database, proving that the controller have no complainant's data stored and how the controller proceeds to customer requests for the removal of personal data from its database. The controller states that this case is most likely an IT error or complainant might have provided voluntarily his email address to one of the controller's partners at that time through marketing campaign, where upon entering his email address he might enter into competition to win certain prices and that way gave permission to use his e-mail address for marketing purposes of the controller's partners at that time. The controller states that he has none of complainant's personal data stored or available, which was proven by attached screenshots. The controller adds that every customer has an option to unsubscribe from any or all of its communications - newsletters includes - at the bottom of every email, or data subjects could contact the controller via telephone or e-mail to anonymise all given personal data.

Pursuant to Art 4 (7) GDPR, for the purposes of this Regulation: 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Pursuant to Art. 4 (23) GDPR, for the purposes of this Regulation: 'cross-border processing' means either:

(a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

Pursuant to Art. 15 GDPR, the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

ÚRAD NA OCHRANU OSOBNÝCH ÚDAJOV SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the data subject, any available information as to their source;
(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Pursuant to Art 56 (1) GDPR, without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.

Pursuant to Art 56 (2) GDPR, by derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.

The purpose of personal data protection proceeding (hereafter as “proceeding”) is to determine whether there was any infringement of the rights of natural persons when their personal data were processed or if there was any violation to this Act or GDPR in the area of personal data protection; and, if any deficiencies are identified, if it is reasonable and useful, to impose corrective measures or impose a fine for violation of this Act or GDPR.

Pursuant to Sec. 100 (1) of the Slovak Data Protection Act, the proceeding is initiated based on the complaint of a data subject that claims that his or her rights lay down by this Act are directly influenced (hereafter as “the complainant”), or without a complaint.

Pursuant to Sec. 100 (5) (a) of the Slovak Data Protection Act, (5) The Office shall dismiss the complaint if the complaint is manifestly unfounded.

On the basis of abovementioned findings, the Slovak SA shall dismiss the complaint pursuant to Sec. 100 (5) (a) of the Slovak Data Protection Act, because during the investigation the controller had proved that the controller had no complainant's personal data stored in its database. The complainant had sent to the controller the Request for access pursuant to Art. 15 of the GDPR via e-mail [REDACTED] on August 19, 2019. The controller had replied from email address [email protected] on August 22, 2019 that Factcool s.r.o. (Slovakia) sold Factcool.com online store to FC ecom s.r.o. (Slovakia) and that Factcool s.r.o.

ÚRAD NA OCHRANU OSOBNÝCH ÚDAJOV SLOVENSKEJ REPUBLIKY

odbor správnych konaní
Hraničná 12, 820 07 Bratislava

only sold goods in Slovakia. The controller explained to the complainant in this e-mail that in Slovenia (from where the complainant is), Factcool Ltd. from United Kingdom sold the Factcool.com online store. The controller wrote to the complainant that FC ecom s.r.o. (the controller) does not have any customer data from Factcool Ltd as Factcool Ltd own the data for Slovenian market. Pursuant to Art. 15 of the GDPR, the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information in the letters a) to h) of the Art. 15. The controller had reacted to the complainant's request up to 3 days after complainant sent their request. On August 22, 2019 the controller confirmed to the complainant that FC ecom s.r.o. (the controller) does not have any customer data from Factcool Ltd as Factcool Ltd owns the data for Slovenian market, thus the access for information in the letters a) to h) is appeared to be objectively non-accessible in this case. The controller has fully cooperated with the Slovak SA and has attached screenshots from its database, proving that the controller has no complainant's personal data stored in its database and does not process any of complainant's personal data according to Art. 15 of the GDPR.

A complaint may be lodged against this decision within 15 days from the delivery of this decision pursuant to Slovak National Act no. 9/2010 Coll. on complaints. This does not affect the right to an effective judicial remedy against a legally binding decision of the supervisory authority pursuant to Art. 78 par. 1 GDPR.

- The complaint pursuant to Act no. 9/2010 Coll. must be in writing and can be submitted in paper or electronic form.
- The complaint pursuant to Act no. 9/2010 Coll. must contain the name, surname and address of the complainant. If the complaint is submitted by a legal entity, it must contain its name and registered office, name and surname of the person authorized to act on its behalf. The complaint in paper form must contain the complainant's handwritten signature. If it is possible to deliver documents to the complainant in accordance with this Act in electronic form, the complaint may also contain the complainant's address for such service.
- The complaint pursuant to Act no. 9/2010 Coll. must be legible and comprehensible. It must be clear from whom it is directed, what shortcomings it points out and what the complainant claims (hereinafter referred to as the "subject of the complaint").

Should new relevant facts be identified in a complaint lodge against this decision, the case could be reviewed in the personal data protection proceedings.

JUDr

Head of the Department

of administrative proceedings

Office for Personal Data

Protection of the Slovak Republic

Veri Erişim Hakkı Şikayetinin Reddi

Türkçe özet

Hukuki mesele

Sonuç

Karar metni