Berlin Commissioner
for Data Protection
and Freedom of Information
521.13177.27
IMI CR 175641
A60DD 431495
November 4, 2022
# Final Decision
# Reprimand
Complainant: [Redacted]
Your letters of 15 December 2020 and 29 April 2021
Dear Mr. [Redacted],
The Berlin Commissioner for Data Protection and Freedom of Information (Berlin DPA) hereby reprimands your company for an infringement of the General Data Protection Regulation (GDPR).
# Reasoning:
The Berlin DPA bases this decision on the following considerations:
I.
The Berlin DPA has established the following facts:
The complainant submitted that he placed an order with [REDACTED] on 16 June 2020 with the number [REDACTED] Subsequently, [REDACTED] passed on hisdata to [REDACTED].
The complainant had then received a delivery notification from them by e-mail. The
Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI)
Alt-Moabit 59-61, 10555 Berlin
Germany
Phone: +49 30 13889-0
Fax: +49 30 215 50 50
Office hours: Monday to Friday from 10 am to 3 pm, Thursday from 10 am to 6 pm
E-mail: [email protected]
Website: www.datenschutz-berlin.de
BERLIN
complainant stated he had not given his consent to the forwarding of your data to
informed us that the complainant had consented to the transfer of his data to by confirming the General Terms and Conditions of Business (GTC) and the data protection declaration as part of the order.
Furthermore, submitted that it employs less than nine employees who are entrusted with the processing of personal data. The managing director of is also the data protection officer.
# II.
Legally, the Berlin DPA assesses the established facts as follows:
The company has infringed the GDPR.
1. Infringement of Art. 5 (1) and Art. (6) (1) GDPR
Your company has violated Art. 5 (1) and Art. (6) (1) GDPR, as the transfer of the complainant's e-mail address to took place without a legal basis.
The permissibility of data processing follows the principle of prohibition with reservation of permission. Accordingly, any data processing must comply with the principles set forth in Art. 5 (1) GDPR as well as at least one of the legal bases set forth in Art. 6 (1) (a) to (f) GDPR. In the present case, a legal basis for the data processing is not apparent.
a) There is no effective consent within the meaning of the first sentence of Art. 6 (1) (a) GDPR.
Page 2 of 6
has submitted that the complainant has confirmed to have read the GTC. The GTC in turn contained the data protection declaration with a reference to the transfer of data to the respective parcel service provider. From this, deduces the consent to the data transfer. Irrespective of the question of whether effective consent can be given in this way at all, the Berlin DPA does not have sufficient proof of consent to the GTC within the meaning of Art. 7 (1) GDPR.
Furthermore, such a confirmation that the GTC have been read is invalid pursuant to Section 309 No. 12 b) German Civil Code. According to Section 309 No. 12 b) German Civil Code, a provision by which the user changes the burden of proof to the detriment of the other party to the contract, in particular by having the other party to the contract confirm certain facts, is invalid. If a pre-formulated read confirmation is obtained by clicking on a checkbox, this involves an inadmissible reversal of the burden of proof to the detriment of the customer, which results in the invalidity.
Moreover, an effective consent to data processing can only be obtained through the use of general terms and conditions in exceptional cases. According to Art. 4 (11) GDPR, consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
In the event that the data subject's consent is given by means of a written statement, which also concerns other matters, Art. 7 (2) GDPR provides that the request for consent must be made in an intelligible and easily accessible form in plain and simple language in such a way that it can be clearly distinguished from the other matters. This rule also applies to electronic declarations. Therefore, the consent would have to be clearly emphasised in the GTCs, for example by placing it in bold, framing it or highlighting it in colour (emphasis requirement). It must also be clearly indicated in the text requesting consent to the GTC that consent under data protection law is also obtained with the confirmation and for what purpose. This is to ensure that the data subject makes the declaration of consent consciously and in an informed manner and that this is not lost in the context of the confirmation of the GTC.
Also, the wording in the GTC of
Page 3 of 6
is only of an informative nature and is therefore not suitable for obtaining an effective consent. It is not clear from the wording that consent to the data transfer is to be given by confirming the GTC. Furthermore, the text part is not visually distinguishable from the rest of the text.
Additionally, the voluntary granting of consent requires that the data subject has a genuine choice. Pursuant to Art. 7 (4) GDPR, it must be ensured that the performance of a contract or the provision of a service is not made dependent on consent to data processing that is not necessary for the performance of the contract. In the present case, the transmission of the e-mail address to is not necessary for the performance of the contract, as the delivery information could be passed on to the customer by the company itself, for example by means of a link to track the shipment. In addition, it is assumed that consent was not given voluntarily if - as in the present case - consent is a non-negotiable part of the terms and conditions (cf. European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, p. 8).
The first sentence of Art. (1) (a) GDPR can hence not serve as a legal basis.
b) Other legal bases, the first sentence of Art. 6 (1) (b) to (f) GDPR
The transmission of the e-mail address to cannot be based on a legal basis of the first sentence of Art. 6 (1) (b) to (f) GDPR. In this respect, only the first sentence of Art. 6 (1) (b) and (f) GDPR come into consideration. In both cases, however, the necessity of the data processing is lacking.
## 2. Infringement of the second sentence of Art. 38 (6) GDPR
There is an infringement of the second sentence of Art. 38 (6) GDPR. According to the second sentence of Art. 38 (6) GDPR, the controller or processor must ensure that other tasks and duties of the data protection officer do not lead to a conflict of interest.
Due to this rule, the office of the data protection officer cannot be held by a key decision-maker of a company, such as a member of the controller's management. According to the first
Page 4 of 6
sentence of Art. 38 (6) GDPR, a data protection officer may take on other tasks and duties, but these may not lead to a conflict of interest. The data protection officer shall exercise his/her duties and tasks in complete independence (cf. recital 97). It is not compatible with the position and function of a data protection officer if he or she would have to control his or her own activities. Such an overlap of the spheres of interest would impair the required complete independence of the data protection officer. Since the function of the data protection officer in the present case is exercised by the managing director, there is an infringement of the second sentence of Art. 38 (6) GDPR. In this respect, it is irrelevant if the managing director himself is of the opinion that there is no conflict of interest and that the required independence exists.
An infringement must also be established if, pursuant to Art. 37 (1) GDPR, possibly in conjunction with Section 38 (1) German Federal Data Protection Law (BDSG), there is no obligation to appoint a data protection officer, but such an officer is appointed voluntarily (first sentence of Art. 37 (4) GDPR). The existence of an obligation to appoint a data protection officer is not evident in the case of [REDACTED]. In particular, the threshold of the first sentence of Section 38 (1) BDSG, according to which a data protection officer must be appointed if a controller generally employs at least 20 persons on a permanent basis with the automated processing of personal data, has not been met. However, the company has voluntarily decided to appoint a data protection officer. If a company voluntarily decides to appoint a data protection officer, this leads to a full application of Art. 37 to 39 GDPR (Art. 29 Working Party on Data Protection, Guidelines on Data Protection Officers ("DPO"), WP 243 rev.01, p. 6).
# III.
As a result, the Berlin DPA does not intend to take any further supervisory measures due to the infringement, but to leave it at a reprimand.
The reprimand is based on Art. 58 (2) (b) GDPR.
With regard to the infringement under 1. (Art. 5 (1), 6 (1) GDPR), this is already your second infringement, so the Berlin DPA assumes that [REDACTED] acted in full knowledge of the
Page 5 of 6
facts. Nevertheless, the Berlin DPA decided to leave it at a reprimand once again, taking into account the circumstances [REDACTED] has presented:
[REDACTED] has stated that after the first infringement was discovered by the Berlin DPA, [REDACTED] commissioned a service provider with the logistics of [REDACTED] online trade, as a result of which the transmission of the e-mail addresses to the parcel service providers was stopped. However, due to pandemic losses in turnover, [REDACTED] could not continue to employ the service provider, so that [REDACTED] initially reverted to the previous solution in order to maintain its business. In the meantime, however, [REDACTED] had changed its practice again so that e-mail addresses were no longer transmitted to the parcel service providers. Due to the fact that the violation was stopped immediately, in which the procedure was changed again and as it was an individual case, we have decided to issue a reprimand here.
The Berlin DPA has taken into account the fact that [REDACTED] has been reasonable and has already stopped the behaviour complained of in relation to infringement 1. The Berlin DPA has also taken into account that the company is a small to medium-sized enterprise. Even though small and medium-sized companies are equally bound by data protection regulations, they are generally not able to provide comparable resources as larger companies for checking compliance with data protection regulations and making any necessary adjustments. However, the Berlin DPA would like to point out that it reserves the right to re-examine compliance with data protection regulations.
With regard to infringement 2 (Second sentence of Art. 38 (6) GDPR), [REDACTED] announced that it would review the appointment of an external data protection officer. The Berlin DPA assumes that [REDACTED] will immediately remedy the alleged infringement on its own.
In the certain expectation that [REDACTED] will comply with the data protection regulations in the future, the Berlin DPA considers the matter closed.
[Legal Notice not translated]
Page 6 of 6