ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
REPUBLIC OF ESTONIA
DATA PROTECTION INSPECTORATE
ASUTUSESISESEKS KASUTAMISEKS
Teabevaldaja: Andmekaitse Inspektsioon
Märge tehtud: 03.10.2022
Juurdepääsupiirang kehtib kuni: 03.10.2027
{accessRestrictionEndDesc}
Alus: AvTS § 35 lg 1 p 2
SA Croatia
IMI
Yours: {senderRegDate} nr
{senderRegNumber}
Our: {regDateTime} nr
{regNumber}
# Final decision
Croatian SA forwarded Estonian SA a complaint, in which a person explains that a driver working under [REDACTED] has been using their provided phone number to contact them separately after they had finished the drive [REDACTED] has already explained to the complainant that the driver contacting them is against the rules of their service.
Based on the information, Estonian SA started official proceedings regarding the case and we have sent the company two suggestions in order to change their system so the phone number would not be available for the drivers to avoid similar situations in the future. Main issue is showing customers' phone numbers on the app and it should be avoided. [REDACTED] has responded to each of our suggestions and questions, explaining what has been done and will be done in the future.
Receiving your question about updates with the case, we have confirmed with the company to clarify what they have done and how has the situation developed.
On 01.08.2022 [REDACTED] replied and stated that implementing the necessary IT solutions has been almost concluded and they will stop showing the phone number in Croatia first. From 08.08.2022 the company will start testing the changes and in no less than two months the number will not be shown when using [REDACTED] application.
[REDACTED] also confirms that they are working on online calls system ([REDACTED]) and changing chat option to be used globally; this has already been almost fully concluded as well. As an explanation, they say that in [REDACTED] app, they are already using and developing chat function as well as online phone calls ([REDACTED]), which makes sure that customer's phone number is not being shown. These changes and additions will be done country by country as soon as possible and the goal is to use the same system globally eventually.
It is also added that in cases when there are problems with using internet (either Wi-Fi or phone data), there is a confirmation form by the driver where they explain the reason to share the number, user's agreement or phone masking service, depending on the country and service.
[REDACTED] believes that these explained measures are enough to lower the risks of data misuse. Additionally, according to [REDACTED] app terms of use, drivers have to only use personal data in accordance with GDPR regulations, meaning they can only use personal data in order to provide the service. In cases these conditions are being breached, the company has the right to deactivate the driver's account.
Draft decision was submitted and there were no opposing comments or questions, thus we will proceed with the final decision.
To conclude, we confirm that there was a breach of GDPR and it has been identified. However, as data processor is working on solving the situation and there are certain plans and processes being concluded to avoid similar situations in the future, SA Estonia will conclude
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
the proceedings and the case, letting [REDACTED] know that this case is finished. However, we will ask the data processor to notify Estonian Data Inspectorate in the future, as soon as necessary changes have been made in every country.
Best regards,
[REDACTED]
lawyer
authorized by Director General
2 (2)