ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
ASUTUSESISESEKS KASUTAMISEKS
Teabevaldaja: Andmekaitse Inspektsioon
Märge tehtud: 07.11.2022
Juurdepääsupiirang kehtib kuni: 07.11.2097
Alus: AvTS § 35 lg 1 p 2, AvTS § 35 lg 1 p 13
FINAL DECISION (IMI 453247) Our: 14.12.2022 nr 2.1.-1/22/1918
SA Finland
Notice of termination of the proceedings concerning the protection of personal data
SA Finland forwarded Estonian SA a complaint, in which the complainant states that they
received an e-mail from stating that an account was created for them. They
added that they themselves had never contacted the company before.
The complainant contacted the company’s customer service and asked them to provide them
with the information regarding receiving their personal data and requested their data to be
deleted. They did not receive adequate information in response to their request. SA Finland
also contacted but did not get an answer.
Based on the information, Estonian SA started official proceedings regarding the case. We
forwarded them our questions regarding the situation and explained under which
circumstances personal data can be processed, referring to GDPR article 6 and 17.
replied that they do not have information regarding who signed the complainant
up on their site, as this person did not finish the authentication process. They did, however,
confirm that by now, the complainant’s data (including their account) has been deleted and
they also provided a proof from the system, stating there are no matches for the complainant.
Customer service representative stated that as soon as they got a complaint from the customer,
on 28.10.2021 the data was deleted and answer provided to the complainant. They, however,
informed the company about still receiving mails. Deletion process was done once again,
thinking that there was an error last time. explained that the system
synchronization with the advertisement system takes up to 24 hours. An e-mail was sent out to
the mailing list on 28.10.2021 (opened by the complainant the day after), before this deletion
was synchronized. As the representative deleted the information again, it shows the date of it
as 01.11.2021.
further adds that person’s data is being processed only when they have
authenticated their account and would like to receive a service (get a loan). During this case,
only the complainant’s name and e-mail was being processed, no further information was
collected or looked at.
As the data processor has provided all necessary answers and confirmed the data deletion,
there is not infringement of GDPR. Furthermore, it does not seem that was
responsible for the data processing, as an unknown person signed up, using the complainant’s
e-mail address. did not have a way to confirm if this was done by the person
themself, as the authentication process was never finished.
Estonian SA forwarded beforementioned information to SA Finland, who has confirmed that
the complainant is satisfied with the solution and this case can be considered solved amicably.
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
SA Finland notes, however, that the system is using seems unreasonably in a
sense that there can be cases where people do not start using their accounts, they just sign up
via e-mail, but do not actually use their accounts.
For that, we are suggesting the company to look over their registration process and if not
already, then in the future, have the system to delete inactive accounts after reasonable time.
To conclude, SA Estonia will terminate the proceedings concerning the protection of personal
data regarding with a suggestion to modify their system and not store data that is
not relevant to them after a certain period.
Best regards,
lawyer
authorized by Director General
2 (2)