BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
Our reference: LDA-1085.1-2993/22-F
IMI Art. 56: 399988
IMI draft decision: 538804 INOFFICIAL TRANSLATION
Controller:
On the basis of the draft decision of the National Data Protection Commission Luxembourg (CNPD) No.
538804, the Data Protection Authority of Bavaria for the Private Sector (BayLDA) pursuant to Article 60(8)
of the GDPR issues the following
Final Decision:
The complaint is rejected.
Justification:
I. Facts
The complaint was received by the BayLDA on 9 April 2022 and was forwarded via IMI to the CNPD as
the lead data protection supervisory authority for the controller.
In his complaint, the complainant stated that he is a client of the controller. The latter transmitted his
personal data to a service provider unknown to him, without a basis in data protection law.
He concluded this as he had been contacted by telephone on 16 March 2022 by that service provider.
The caller knew personal data relating to the complainant’s identity and his business relationship with
the controller.
The CNPD concluded that the complainant requested a review of the lawfulness of the processing in
accordance with Articles 5 and 6 of the GDPR.
In accordance with Article 57(1)(f) of the GDPR, the CNPD requested the controller to take a position
on the facts reported by the complainant and in particular to provide a detailed description of the is-
sue relating to the processing of the complainant’s data, and in particular with regard to the lawfulness
of the processing.
In the course of those investigations, the CNPD received the following explanations from the controller
in due time:
a. By letter of 2 December 2021, the controller (an online bank distributing credit cards and insurance
products) sent the complainant an invitation to participate in a raffle.
b. On 21 December 2021, the complainant stated that he wished to participate in this raffle and gave
his consent to be contacted by e-mail, SMS and telephone for advertising purposes.
c. On 16 March 2022, the complainant as part of a marketing campaign concerning the controller’s
‘Payment Protection Insurance’ product was contacted by the company , which provides and
advertises this product on the German market for the controller.
d. On 26 March 2022, the complainant asked the controller to explain when he had given his consent
in this regard.
e. In his reply of 21 April 2022, the controller explained to the complainant the consent given in the
context of the raffle. The complainant also received a copy of the consent form.
II. Conclusion
At the end of its investigations, the CNPD concluded that the controller had sufficiently demonstrated
the lawfulness of the contested processing under Articles 5 and 6 of the GDPR.
In view of the facts of the case and taking into account the gravity of the alleged facts and the degree
of impact on fundamental rights and freedoms, the CNPD did not consider it necessary to pursue the
complaint further.
It therefore contacted the BayLDA with the results of the investigations to date, which the BayLDA ex-
plained in its letter of 16 September 2022 to the complainant, asking whether, despite the findings to
date, there were reasons for continuing the complaint in his view. BayLDA received no reply from the
complainant and informed the CNPD thereof. The CNPD concluded that no further action was neces-
sary and that the cross-border complaint could be rejected.
Consequently, the CNPD decided to reject the complaint and, via IMI, sent the relevant draft decision
No. 538804 to the concerned supervisory authorities. The concerned supervisory authorities (including
BayLDA) did not object to the draft decision.
In accordance with Article 60(8) of the GDPR, the final decision in the present case must be adopted by
the BayLDA.
Ansbach, 17 August 2023