ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
ASUTUSESISESEKS KASUTAMISEKS
Teabevaldaja: Andmekaitse Inspektsioon
Märge tehtud: 25.08.2022
Juurdepääsupiirang kehtib kuni: 25.08.2097
Alus: AvTS § 35 lg 1 p 12
Your: 28.03.2022
Our 25.08.2022 nr 2.1.-1/21/3287
Reprimand and notice of termination of termination of proceedings in a personal data
protection case
The Data Protection Inspectorate received a complaint from the data protection authority of the
Republic of Lithuania via the cross-border procedural system IMI concerning contact with
via and the transfer of his personal data through
to third parties (the applicant’s mother )
Lithuanian branch representative .
On the basis of the above, I initiated supervision proceeding on the basis on clause 56(3)(8) of
the Personal Data Protection Act. As part of the supervisory procedure, I made enquiries about
the processing of personal data by .
has replied to inquiries and explained the grounds for processing personal data.
has explained that it processes personal data for the performance of a
contract entered into with the participation of the data subject, for the performance of the legal
obligations of and also on the basis of a legitimate interest.
acquires claims on the basis of an assignment agreement entered into by the original creditor,
replacing the assignor and becoming the new owner of the claims. has acquired
’s claim against . The purpose of the processing of personal data is
the fulfilment of the business interests and purposes of , i.e. the successful
satisfaction of claims. has been contacted by the employees of the Lithuanian
branch of , a subsidiary of , and they have used the
following channels: registered mail, regular mail, email, and phone.
The Lithuanian branch of has also contacted through
was sent the first and last name of and
the year and month of birth. In such a case, has indicated as the basis for the
transfer of personal data the legitimate interest and the purpose of forwarding the request for
contact to the debtor. has also submitted an analysis of legitimate interest.
Position of the Data Protection Inspectorate
There must be a legal basis for the processing of personal data as set out in Article 6 of the
General Data Protection Regulation (GDPR). Regardless of the legal basis, the data controller is
required to comply, inter alia, with the principles set out in Article 5 of the GDPR, including:
Tatari 39, 10134 Tallinn Telefon 627 4135
Registrikood 70004235 E-post [email protected] www.aki.ee
- Processing must be lawful, fair and transparent
- Personal data collected for specified and explicit legitimate purposes
- Personal data are relevant, relevant and limited to what is necessary for the purposes for
which they are processed.
Compliance with this obligation must be demonstrated by the controller (Article 5(2) of the
GDPR). Personal data may be processed only to the extent necessary to achieve the specified
purposes and it must be ensured that the purpose of the processing is ensured by the least
possible interference with fundamental rights. In order to do so, the data controller must assess in
advance whether the processing of the data is strictly necessary for the fulfilment of the purpose
or whether the fulfilment of the purpose is limited to less harmful measures.
Processing of personal data related to the debtor
For the processing of personal data related to the debtor, relies on Article
6(1)(f) GDPR (legitimate interest). collects data related to the debtor from
public sources in the event that no contact has been made with the debtor.
According to Article 6(1)(f) GDPR, processing of personal data is lawful where processing is
necessary for the purposes of a legitimate interest pursued by the controller or by a third party,
unless such interests are overridden by the interests or fundamental rights and freedoms of the
data subject which require the protection of personal data. In order to assess the existence of a
legitimate interest, the controller is obliged to compare his or her legitimate interest with the
interests and fundamental rights of the data subject, and as a result it becomes clear whether it is
possible to rely on Article 6(1)(f) GDPR as a basis for processing.
The assessment of legitimate interest must assess whether the impact of the processing on the
data subject is proportionate to the objective pursued. An infringement of fundamental rights is
excessive if there is another instrument that helps to achieve the stated objective just as well, but
does not adversely affect the rights of a person. When assessing the extent of the impact of the
interests on the data subject, account must be taken, among other things, of the reasonable
expectation of the data subject, i.e. that his or her personal data will not be processed in a manner
that he or she cannot reasonably foresee and whether the data controller’s objectives can be
achieved by less harmful methods. The interference with fundamental rights and freedoms is
excessive if there is another instrument that helps to achieve the stated objective just as well, but
does not adversely affect the rights of a person.
The Data Protection Inspectorate found that the processing of personal data related to debtors for
the purpose of contacting the debtor cannot be based on the grounds of legitimate interest or on
the other grounds set out in Article 6 of the GDPR. The close relatives of the debtor have no
connection with the debtor’s debt, they are not liable to the debtor’s outstanding obligations.
Thus, the close relatives of the debtor cannot reasonably expect that their personal data will be
processed in connection with the debts of someone they know, a friend of a relative, etc. It also
showed that has alternative measures to achieve the objective (referral to
court, implementation of bailiff’s assistance). The cost of an alternative measure that harms
privacy less or not at all cannot be the only one. The Supervision Authority found that the
interference with the fundamental rights and freedoms of the debtor’s close relatives is excessive,
so not all the elements of legitimate interest have been fulfilled and it is not possible to rely on
the basis of legitimate interest.
On the basis of clause 56(2)(8), 58(1) of the Personal Data Protection Act and Article 58(1)(f)
and (g) of the GDPR and taking into account Articles 5 and 6 of the GDPR, the Data Protection
Inspectorate issued to a mandatory injunction to terminate the processing of
personal data relating to the close of debtors on the basis of the legitimate interest of the
company for the purpose of contacting the debtor and to delete the personal data of the persons
close to debtors collected so far on that basis and for that purpose.
2 (3)
has assured the Supervision Authority that it has complied with the precept.
Processing of debtor’s personal data
has a legal basis for processing the debtor’s personal data, but the
processing of debtors’ data must also be based on the reasonable expectations of the data subject.
Debtors cannot reasonably expect the information relating to their debt to reach their vicinity
through the creditor. Creditors do not have the right to share debt information with third parties
(relatives, friends, acquaintances, employers, etc.) unless the debtor has given their consent.
has confirmed that upon contacting the debtor’s relatives etc., the data will be
transmitted to the minimum extent, and that data on the debtor’s debt will not be communicated,
but will be asked to forward a notification to the debtor to contact the company. However, it must
be taken into account that the activity of the companies belonging to the group
is debt collection, so there is a high probability that the close-up of the debtor can assume that
contact with the debtor is sought precisely because of the breach of his obligations. Creditors
have alternative methods in place, data processing cannot be justified solely on economic and
convenience grounds.
has confirmed that was contacted via
has also submitted a screenshot of correspondence via
to the Supervision Authority. The display shows that the user with whom
’s employee interacted uses the username in . Using the search on
, you can see that this account comes in the field using ’s name, as
well as the name on the linked user account.
Creating an account in social media channels generally does not require identification, and each
account creator has the opportunity to choose a name that is not actually related to his/her
identity as the username of the account. It is also not uncommon for there to be several people
with the same name. Due to this, the company has to take into account the risk of contacting the
wrong person and transferring data for which there is no legal basis. There must not be a
situation where personal data is transferred to outsiders.
On the basis of the above, the Data Protection Inspectorate terminates the supervisory
procedure and reprimands
in accordance with Article 58(2)(b) of the GDPR and points out that the
processing of personal data must comply fully with the principles of processing personal data set
out in Article 5 of the GDPR, including the processing of personal data must be lawful,
purposeful and transparent. Processing of personal data is lawful only if one of the grounds laid
down in Article 6(1) GDPR is fulfilled.
This decision may be challenged within 30 days by submitting:
- an appeal to the Director General of the Data Protection Inspectorate in accordance with
the Administrative Procedure Act, or
- appeal to the administrative court on the basis of the Code of Administrative Court
Procedure (in this case, the appeal can no longer be examined in the same case).
With respect
(signed digitally)
lawyer
under the authority of the Director-General
3 (3)