ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
INTERNAL INFORMATION
Information holder: Estonian Data
Protection Inspectorate
Date: 11.12.2023
Valid until: 11.12.2098 Legal ground:
Public Information Act § 35 (1) p.2, p.12
Ours: 11.12.2023 nr 2.1.-1/23/631-
1611-7
ARTICLE 60 FINAL DECISION
Notice of termination of proceedings concerning the protection of personal data
Estonian Data Protection Inspectorate (Estonian DPI) received a complaint from Spanish
citizen (the Complainant) through European Commissions Internal
Market Information System (IMI) against (the Controller, ). Since the
Controller has its main establishment in Tallinn, Estonia, Estonian DPI has accepted the case
as LSA.
THE COMPLAINT AND THE COURSE OF PROCEEDINGS
1. According to the complaint, the Complainants’ personal data (debt information) has
been transmitted to a Spanish payment default registry
. The Complainant claims that
she has not been notified of the existence of the payment default by the Controller, how
the payment default occurred and of the fact that the debt claim will be transmitted to
the local payment default registry. In addition to that the Complainant claims that while
entering into a contractual relationship with the Controller, she was not made aware of
the possibility that her personal data might be disclosed to a payment default registry
and not specified to which one.
2. According to the complaint, after discovering that her personal data was disclosed by
, the Complainant has tried to exercise her right of access (GDPR Art 15) in
order to obtain confirmation from the controller as to whether and which
data concerning her are being processed, but received no reply from the Controller.
3. The Complainant has applied for the Controller to restrict the processing of her personal
data while the accuracy of the personal data is contested by the data subject for a period
enabling the Controller to verify the accuracy of the personal data as per GDPR Art 18
(1) a).
4. Estonian DPI initiated supervision proceedings on the basis of clause 56 (3) 8) of the
Personal Data Protection Act and has sent several inquiries to the Controller. The aim
of the supervisory proceedings was to clarify the legal basis of data processing and
whether the Controller has taken appropriate measures to provide necessary information
referred to in GDPR Article 13 and any communication under GDPR Article 15.
5. Estonian DPI has asked the Controller to restrict the processing of personal data of the
Complainant during the supervisory proceedings as per GDPR Art 18 (1) a).
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
CONTROLLER´S EXPLANATIONS
6. The Controller has explained that the personal data of the Complainant is being
processed on the basis of GDPR Art 6 (1) b), in order to perform the loan agreements.
7. The payment defaults origin from two loan agreements that the Complainant has entered
into with the Controller – nr (signed on 08.10.2019) and nr
(signed on 20.02.2020)1. The signed loan agreements were sent to the Complainant´s e-
mail address after signing and they have also been available through ´s portal.
8. Last partial repayments made by the Complainant were on 09.03.2020 (€3.57 for loan
agreement and €4.30 for loan agreement ), after which the
Complainant did not repay the debt in three following months. has sent a
warning on 10.06.2020 regarding terminating the contract because of unfulfillment of
the contract by the Complainant and on 10.07.2020 terminated the contracts with the
Complainant and notified her.
9. uses an automated debt data processing system, where debt information is
regularly communicated to the debtor via sms, e-mails, automated telephone calls. In
addition to that, debt collectors communicate with the clients on daily basis reminding
them their duties to repay the debt or negotiate the repayment terms.
10. has been in constant communication with the Complainant – ´s log
file2 proves that tens of reminders, notifications, and repayment options have been sent
to her.
11. has sent a debt notification to the Complainant on 10.03.2020 via e-mail3
informing her about the debt and ´s right to transmit the information to
unless the debt is settled in 30 days. At the same time offered the Complainant
the possibility to schedule a repayment, however the Complainant did not want to use
these opportunities.
12. In addition to the Controller´s e-mail, has sent the Complainant a letter through
registered post on 26.03.2020 with the debt information and a notification that if the
debt will not be repaid in 15 days, it will be disclosed at payment default
registry. The letters with the confirmation from postal service provider have been
attached this document.4
13. The debt data was transmitted to the payment default registry on the basis of GDPR
Art.6 (1) f) – legitimate interest of the Controller.
14. The information regarding the debt has also been available to the Complainant through
´s portal. The Complainant had access to her account at firstly because
the loan agreement cannot be signed without a valid e-mail address and creating an
account at ; secondly ´s log files5 prove that the Complainant has
regularly logged into her account until the end of 2022.
15. The loan agreements that the Complainant signed state under p. 13 that has the
right to transmit the information to payment default registry when the repayments are
not made: Following a payment overdue or default under the Loan Agreement, the
Lender shall have a right, in each case pursuant to the applicable law, to notify the
Borrower thereof and send the following information to the chosen Payment Default
Register.6
1
Appendix 1 (Loan agreement ) and Appendix 2 (Loan agreement )
2
Appendix 3 – Sent notifications
3
Appendix 4 – copy of the e-mail notifying overdue payment
4
Appendix 5, 6 (English translation), 7, 8 (English translation)
5
Appendix 9 - customer activity log
6
Loan agreements of Appendix 1, p.13.1
2 (6)
loan agreements, the information was in her possession contrary to what was said in the
complaint.
23. Pursuant to Article 6(1)f) of GDPR processing is necessary for the purposes of the
legitimate interests pursued by the controller or by a third party, except where such
interests are overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data. According to the Controller - the debt
data was transmitted to the payment default registry on the basis of GDPR Art.6
(1)f).
24. In order to rely on GDPR Art.6 (1)f) as a legal basis of processing (transmitting personal
data to a payment default registry), the Controller should be able to demonstrate that
their legitimate interest overrides the impact on individuals´ interests and rights and
freedoms. This requires a balancing test that compares the controller´s and the data
subjects’ interests or fundamental rights and freedoms. The Controller has provided the
legitimate interest analysis to Estonian DPI.
25. is a creditor who offers different loans to data subjects. Consequently,
’s interest is to claim the debts. If the data subject has not fulfilled their
obligation and has failed to make loan payments, as a controller has an interest
to share that information with payment default registry. In this case the Complainant
has signed loan agreements with but has not fulfilled her obligations to repay
the loans.
26. Complainants’ interest is to protect their personal data and to be treated equally to other
people who do not have payment difficulties. However, person´s right to the protection
of personal data is not an absolute right, it must be considered in relation to its function
in society and be balanced against other fundamental rights, in accordance with the
principle of proportionality. Payment default registry’s purpose is to give third parties
an opportunity to assess the creditworthiness of the data subject and therefore protect
transaction reliability. When the data subject fails to make loan payments, the creditor
has a legitimate interest to transmit personal data to the payment default registry.
27. did inform the Complainant about the possibility of transmission of their
personal data to a payment default registry in case the payment is overdue or default
first of all in loan agreement clause 13.1. and later in an e-mail (10.03.2020) and by post
(26.03.2020).
28. The Complainant failed to pay the debts and therefore her arrears information was
transmitted to . Estonian DPI considers ’s interest valid and therefore
the Complainant´s interests or fundamental rights and freedoms are not overridden when
her personal data was sent to a payment default registry.
29. Taking into account the nature of the personal data processed (debt data), the fact that
the Complainant has not responded to any of the notifications and reminders sent to her
by the Controller and the Complainant was aware of possible measures taken when
repayments are not made in time while signing loan agreements, Estonian DPI is of
opinion that transmitting the data to payment default register was justified.
Information to be provided to the data subject
30. Pursuant to Article 13(3) GDPR where the controller intends to further process the
personal data for a purpose other than that for which the personal data were collected,
the controller shall provide the data subject prior to that further processing with
information on that other purpose and with any relevant further information as referred
to in paragraph 2 to ensure fair and transparent processing.
31. The Controller has given the Complainant all the necessary information regarding her
debt via sms, e-mails, (automated) telephone calls. The annexes sent by the Controller
prove that tens of reminders, notifications, and repayment options have been sent to her.
In addition to that the information regarding the debt has also been available to the
4 (6)
Complainant through ´s portal and log files prove that she has consistently
logged into her account until the end of 2022.
32. The Controller has informed the Complainant on 10.03.2020 via e-mail about the debt
and ´s right to transmit the information to unless the debt is settled in
30 days. In addition to that has sent the Complainant a postal letter through
registered post on 26.03.2020 with the debt information which the Complainant must
have received.
33. According to Estonian DPI, the Controller has provided all the necessary information
regarding the debt information and the transmitting of debt information to the
Complainant.
Complainant´s right of access by the data subject (GDPR Art 15)
34. Pursuant to Article 15(1) GDPR the data subject shall have the right to obtain from the
controller confirmation as to whether or not personal data concerning him/her are being
processed and provide the relevant information about the processing.
35. The Complainant claimed that her request to access her data was not met by the
Controller, however the Controller has disproved this statement by saying that
replied to all of the Complainant´s requests (4.01.2023; 11.01.2023; 22.02.2023;
24.05.2023, 31.07.2023) whereby all the necessary documents (loan agreements and
debt notification) were sent to the Complainant.
36. According to Estonian DPI´s opinion the appendixes added to this document prove that
the Controller has replied to the Complainant sending her all the necessary
documentation regarding her data processing.
CONCLUSION
The Controller processes Complainant´s personal data for the purpose of claiming the debt and
has transmitted the debt data to a payment default registry on the basis of legitimate interest
(GDPR Art.6(1)f). The Complainant has been informed about the debt through numerous
reminders via e-mail, sms, automated telephone calls. In addition to that, the Complainant has
had access to all of her loan data through ´s portal, that she has logged in until the end
of 2022. The information regarding the possibility of transmitting the debt data to a payment
default registry was given to the Complainant when signing the loan agreements and later
through e-mail and postal letter. The Controller has replied to Complainant´s request about her
data processing. In Estonian DPI´s opinion the processing of personal data corresponds to the
requirements set to the Controller by GDPR.
Based on above, Estonian DPI will terminate the proceedings concerning the protection
of personal data in this matter.
Footnote reference documents will be annexed to relevant documents.
Respectfully,
Lawyer
authorized by Director General
Appendixes:
5 (6)
Appendix 1 - Loan agreement
Appendix 2 - Loan agreement
Appendix 3 – Sent notifications from ´s system
Appendix 4 – Copy of the e-mail notifying overdue payment
Appendix 5 – Official notification 1 (ES)
Appendix 6 – Certified Debt notification letter (EN) Translation
Appendix 7 – Official notification 2 (ES)
Appendix 8 - Certified Debt notification letter (EN) Translation
Appendix 9 – Customer activity log
Appendix 10 – response (ES) Original email
Appendix 10a – Attachments to e-mail 04.01.2023
Appendix 10b – Debt confirmation (ES)
Appendix 10c – response to postal letter from January 3rd 2023 (EN) Translation
Appendix 11 – response (ES) original email 2
Appendix 12 – response to petition request 2 (EN) Translation
Appendix 13 – response (ES) Original email 3
Appendix 14 – Recovery Team 3 (EN) Translation
Appendix 15 – response (ES) Original email 4
Appendix 16 – response to customer 4 (EN) Translation
Appendix 17 – response (ES) original email 5
Appendix 18 – response to petition request 5 (EN) Translation
Appendix 19 – Original Doc. Request for (ES)
Appendix 20 – Request for (EN) Translation
Appendix 21 – activities list
6 (6)