BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
09.08.2023
Final decision
Complaint by against (‘ ’) of 29 June 2018 (IMI
Notification No: 537956; Reference of the Bavarian State Office for Data Protection: LDA-1085.4-
7273/18-I)
In the above matter, pursuant to Article 60(8) of the GDPR, the Bavarian State Office for Data Protection Su-
pervision (BayLDA) adopts the following decision on the basis of the draft decision of the Luxembourg su-
pervisory authority (National Commission for Data Protection Grand Duchy of Luxembourg (CNPD) of
13.7.2023):
Dismisses the complaint of 29 June 2018 by against
Reasoning:
I. Facts
After receiving ’s complaint to the BayLDA, it was prepared and forwarded to the lead supervi-
sory authority, the CNPD, for transmission via IMI.
In his complaint, the complainant claimed that he had received multiple unsolicited products via .
He then contacted the company’s customer service. From the correspondence with a customer service
employee, the complainant has concluded that he has made contact with the consignor of the products
and has disclosed to him/her personal data (e.g. name and address).
The main concern was that the competent data protection supervisory authority should investigate whether
his personal data have been disclosed by an employee and, and, if necessary, to take appropriate
measures to prevent such business practices in future cases.
The CNPD concluded from this that the complaint is based on an infringement in the scope of Article 5(1)(f)
GDPR.
In accordance with Article 57(1)(f) of the GDPR, the CNPD has contacted and requested the com-
pany to comment on the facts described by the complainant, in particular to the processing of the com-
plainant’s personal data in the facts described in the complaint.
The company has complied with the request to send an statement, stating that the said orders were made
by a customer account associated with a person bearing the same family name as the complainant (in the
follow-up “third party” – note: both names are known to the CNPD and the BayLDA). In addition, the de-
livery address stored in this customer account is the same as the address of the complainant. Only two or-
ders (on 13 and 14 May 2018) have been successfully placed through this account and it is clear from the
records of the controller that Customer Service sent to this customer account on 13 and 14 May 2018 mes-
sages related to the orders, but no further communication took place in May or June 2018.
...
-2-
The controller had no evidence that an employee of the customer service exchanged personal data with the
third party or that it was a case of so-called “brushing”, given the common names and addresses and the
limited number of products ordered in this way.
The CNPD has informed the controller that the complainant has provided an email from an employee of the
controller dated 16 May 2018 informing the complainant that the employee has informed the third party of
the complaint of the complainant and requested the third party to clarify the matter directly with the com-
plainant. The complainant therefore had reason to believe that his personal data had been unlawfully pas-
sed on to the third party.
II. Legal assessment
The CNPD has determined that even taking into account the above e-mail, it is not possible to prove whe-
ther or which data the company’s employee may have passed on to the “third party”. It would be conceiva-
ble that the employee only described the journey to the third party without disclosing the identity of the
complainant. In any case, it remains unclear (and not proven) which specific data may be affected (e.g.
name and/or address). In addition, the employee concerned acted prudently by not disclosing the third
party’s personal data to the complainant, which in turn led the CNPD to assume that the controller’s
employees were aware of the importance that customer data should not be disclosed to other customers.
The person responsible further confirmed that the said e-mail does not correspond to what is conveyed in
the employee training courses.
The CNPD also noted that the complainant had filed a criminal complaint against unknown to the German
law enforcement authorities, but was discontinued by the public prosecutor’s office due to a lack of evi-
dence.
Finally, it is apparent from the file procedure that the third party already knew the name and address of the
complainant, since the third party had deposited the address in the customer account and had the parcels
delivered to that address before communication with the company’s employee had taken place.
As the lead supervisory authority, the CNPD has therefore decided that, following the conclusion of the in-
vestigation into the facts, there is no evidence that the controller has disclosed the complainant’s personal
data.
For the above reasons and taking into account the seriousness of the alleged breach of data protection law
and the impairment of fundamental rights and freedoms in the area, the CNPD did not consider it neces-
sary to pursue the complaint and reject it.
This decision was to be adopted by the BayLDA in accordance with Article 60(8) of the GDPR.
Bavarian State Office for Data Protection Supervision