Berlin Commissioner
for Data Protection
and Freedom of Information
521. 12549/ 631.196
CR: 74063
Draft Decision
IMI DD 418292
Berlin, 24 August 2022
# Final Decision
# Preliminary remarks
The complaint (ref. no. 521. 12549/ 631.196) was raised before the Berlin DPA in February 2020. It was transferred to the supervisory authority Netherlands, which is the Lead Supervisory Authority (LSA) for the cross-border processing carried out by [REDACTED], in accordance with Article 56 GDPR. The LSA Netherlands conducted the investigation and the cooperation procedure with all concerned supervisory authorities in accordance with Article 60 GDPR. The LSA Netherlands proposed a Draft Decision and thereby the complaint was rejected. In accordance with Article 60 (8) GDPR, the Berlin DPA as the supervisory authority with which the complaint was lodged, hereby adopts the decision as it was agreed upon in the cooperation procedure and is included below:
| IMI Article 56 identification of LSA and CSA entry | 114902 |
| --- | --- |
| IMI Case Register entry | 418274 |
| National file number | NL SA: z2021-05733 |
| Controller | [REDACTED] |
| Date of complaint | 19 February 2020 |
Berlin Commissioner for Data Protection
and Freedom of Information (BInBDI)
Friedrichstr. 219, 10969 Berlin
Visitors' entrance: Puttkamerstr. 16-18
Phone: (030) 13889-0
Fax: (030) 215 50 50
Office hours: Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
Mail: [email protected]
Web: www.datenschutz-berlin.de
BERLIN
With regard to the abovementioned case and pursuant to Article 60(3) of the General Data Protection Regulation (GDPR), the Autoriteit Persoonsgegevens (Dutch Data Protection Authority, hereafter: NL SA) has issued the following draft decision:
# Summary of the complaint
1. NL SA has received a complaint about telephone recordings without the consent of the complainant from the Berlin regulator under our file number z2021-05733. The person concerned ( [REDACTED] pleads the alleged infringement of the GDPR. It follows from the complaint file that [REDACTED] is concerned that the controller [REDACTED] may have recorded a telephone call between him and a customer service employee. The complainant objects to this processing of data concerning him.
2. The Dutch Data Protection Authority (AP) has received this complaint on 30 April 2020.
# Investigation by NL SA
3. NL SA has established that [REDACTED] the Netherlands, is the data controller in this matter. This is confirmed by, inter alia, the correspondence received from [REDACTED] and the privacy policy on [REDACTED]
4. On the 10 May 2021, the NL SA sent an information request to the controller regarding this case. In the request for information, the NL SA submitted the complaint.
5. On 31 May 2021, the controller replied: We have reviewed our systems, but we have not found any information indicating that we have ever received a complaint from [REDACTED] at our special privacy email address [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] It therefore seems that [REDACTED] did not seek to raise his concerns directly to us, nor gave us the opportunity to respond to those concerns, but instead immediately expressed his concern to
2
the Berlin regulator.
6. [REDACTED] also stated: "We have been able to find a phone call that took place on February [REDACTED] linked to the account created for [REDACTED] Our details confirm that this phone call has not been recorded. We are sorry to hear that our customer service officer has created ambiguity at [REDACTED] Since there is no call recording available, we cannot confirm that the content of the conversation took place as [REDACTED] described it. In any case, we will review our guidelines for our customer service staff on call recordings. We can also confirm that the statement "for security purposes shall be recorded, without exception" is incorrect.
7. The NL SA has received no prior information from Berlin SA derived from the preliminary vetting of the complaint.
# Norm allegedly infringed
Art. 6 GDPR jo article 12, 13, 21 GDPR
# Proposed action by the NL SA
1. Firstly the NL SA would like to point out that the lodged complaint was premature as the request for erasure was apparently sent directly to the regulatory authority in Berlin, and not to the company itself.
2. Secondly, there is no clear indication that there is an enforceable obligation on the controller to handle the request of [REDACTED] under the current circumstances. The controller needs to respond to data subject requests without undue delay - and in any case within one month from the receipt of a request. However, no such request is available. Only in the case of the controller's inactivity or refusal to fulfill the request in part or in whole, there is a title to lodge a complaint with referring to an infringement of article 21 jo. article 12, para 3, of the GDPR.
3. Thirdly, NL SA is unable to establish whether call recordings have taken place involving the complainant.
3
4. Furthermore, the NL SA has no indication that the controller is unwilling to facilitate data subject requests. In this case informed the NL SA within one month about their view on the matter.(the letter dated 31 May 2021 after the NL SA's information request on 10 May 2021).
5. Considering above, NL SA considers that there is no evident infringement of the GDPR in this case.
6. NL SA deems this matter investigated to the extend appropriate and rejects the complaint based ex article 60, para 8, GDPR. The supervisory authority with which the complaint was lodged (the regulatory authority in Berlin) shall adopt the decision and notify it to the complainant and shall inform the controller thereof.
The Hague,
12th of July 2022
# Appeal Notice to the complainant
Against this decision a lawsuit before the Verwaltungsgericht Berlin (administrative court of Berlin), Kirchstraße 7, 10557 Berlin is admissible. The lawsuit needs to be filed in written form within one month after the notification of this decision, it can also be filed as an electronic document with a qualified electronic signature (QES) or for the record of the clerk of the court. Please, note that in case of filing the lawsuit in writing the legal deadline is only met if the lawsuit reaches the administrative court within the deadline.
The Berlin Commissioner for Data Protection and Freedom of Information
4