¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
BAVARIAN STATE OFFICE FOR DATA PROTECTION SUPERVISION
Data Protection Authority of Bavaria for the Private Sector
___
Final decision
Complaint by Mr against (‘ ’) of 18 February 2020 (IMI Notifi-
cation No: 5.914; Reference of the Bavarian State Office for Data Protection Supervision: LDA-
1085.3-4347/20-I)
In the above matter, pursuant to Article 60(8) of the GDPR, the Bavarian State Office for Data Protection Su-
pervision (BayLDA) adopts the following decision on the basis of the draft decision of the Luxembourg su-
pervisory authority (National Commission for Data Protection Grand Duchy of Luxembourg (CNPD) of
13.7.2023):
The proceedings concerning Mr ’s complaint against of
18.2.2020 29.06.2018 are closed.
Explanatory memorandum:
I. Facts
After Mr. 's complaint was received by the Bavarian State Office for Data Protection Supervision
(BayLDA), it was prepared for forwarding via IMI to the lead supervisory authority, the CNPD, and forwarded
there.
In his complaint, the complainant argued that, during his absence, ’s delivery service had placed a
package outside his door. However, this package was not addressed to him. In the case of a subsequent
telephone call, the complainant was asked to indicate his date of birth. He did not do this because it was
not his query. ’s employee then noticed that the complainant had a customer account with
and he knew when he was born. Upon asking the complainant how the employee knows this, the employee
informed him of his phone number.
The main concern was that the competent data protection supervisory authority should investigate whether
the data processing with regard to the complainant’s personal data has been lawfully carried out (deposit
and access to the date of birth) and, if necessary, to take appropriate measures to prevent such business
practice in future cases.
The CNPD concluded that the complaint is based on infringements in the scope of Article 5(1)(a), Article
5(1)(b), Article 5(1)(f) of the GDPR.
In accordance with Article 57(1)(f) of the GDPR, the CNPD has contacted and requested the com-
pany to comment on the facts described by the complainant, in particular to the processing of the com-
plainant’s personal data in the facts described in the complaint.
The Company complied with the request to send an opinion in due time, stating that there were no records
of the interaction between the complainant and customer service, as a result of the limited retention period
for customer service contacts. However, it may also be because the verification process was not completed
and the contact was therefore not linked to the complainant’s account. In any event, the conduct of the
...
—2—
customer service representative described by the complainant is not customary by default to identify cus-
tomers who contact customer service by telephone. There were also no records of the date of birth of the
complainant. The verification process does not include the date of birth of a customer.
In order to identify the misguided delivery and provide further information, it was necessary that the person
responsible ) receives the order number specified on the package, as a delivery error could also be
an explanation of the incident.
After consulting the complainant in this regard, the complainant said that the case could now be left to rest
and that no further investigation should be carried out.
II. Legal assessment
After resolving the facts, the CNPD had to find out that without the order number on the package, the facts
could no longer be clarified.
The CNPD, as the lead supervisory authority, in accordance with the complainant's statement to let the
matter rest and not to investigate further, came to the conclusion that the complaint was considered with-
drawn.
The procedure had to be closed.
This decision was to be adopted by the BayLDA in accordance with Article 60(8) of the GDPR.
The BayLDA asks the colleagues of the lead authority on their behalf to inform the controller of this deci-
sion.
Bavarian State Office for Data Protection Supervision
25.08.2023