ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
INTERNAL INFORMATION
Information holder: Estonian Data Protection
Inspectorate
Date: 08.06.2026
Valid until: 06.03.2098
Legal ground: Public Information Act § 35 (1) p.2, p 12
SA Lithuania Ours: 08.06.2023 nr 2.1.-1/2022-
IMI case nr 498430 2190-8
Final Adopted Decision (GDPR Art 60)
Reprimand and notice of termination of the proceedings concerning the protection of
personal data
Estonian Data Protection Inspectorate (Estonian DPI) received a complaint through IMI system
(case nr 436914) from SA Lithuania. Since the Controller – - has its
main establishment in Tallinn, Estonia, Estonian DPI has accepted the case as LSA.
The Complaint
Lithuanian citizen (the Complainant) receieved a message from after
his scooter trip 23.07.2022 claiming that he didn´t use the scooter alone, i.e that the scooter was
simultaneously used by him and one or more other persons. The Complainant did not agree
with this because he did use the scooter alone, therefore asked to reverse the
decision or prove that he did not use the scooter alone. The answers did not satisfy him. The
complainant was advised by that scooters indeed record changes in weight
automatically. The complainant indicated that `s Privacy Policy does not state the collection
of personal body weight, its purpose and legal basis.
Estonian DPI started an investigation and contacted the Controller in order to clarify the process
of collecting data subject´s weight, the purpose and legal basis of processing.
Summary of Controller´s explanations:
1. The aim of the function called Tandem Riding Detection is to detect and prevent riding
e-scooters by more than one person simultaneously due to safety reasons - preventing
possible accidents and unlawful behaviour triggered by tandem riding and educating
users about road rules and safety.
2. The function is based on the data collected from accelerometer about motor force and
forward acceleration. A coefficient is calculated based on those metrics during each
ride and this is the indication whether the end user rides the scooter alone or with
another person.
3. The message will be sent to the user in case the coefficient of current ride is larger
than the median of previous rides coefficients multiplied by 1.5.
4. The weight of the person (including other objects on the scooter, e.g. bag) is being
calculated based on the received data from the accelerator motor.
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
5. No automated individual decisions are made during this process, therefore GDPR
Article 22 does not apply. The notification message does not have any legal
consequences to the user, e.g it does not result in any automated decision such as
blocking the user on the platform.
6. The aim of sending the notification message is to educate the users and to turn their
attention to the fact that tandem riding is prohibited.
7. Another method for accomplishing the same purpose would be to use cameras on
scooters which would infringe user´s rights in a much more profound level and would
be disproportionate.
8. The Controller´s Terms and Conditions state that tandem riding is prohibited and
therefore it could be reasonably expected that those terms may be enforced by the
Controller.
9. The collected data from the accelerometer (including the total weight) will be saved
under user´s account for 6 months in order to compare it with the data of future rides.
10. The legal basis of processing is legitimate interest (GDPR art. 6 (1) p.f) and the
Controller has presented a legitimate interest assessment to Estonian DPI (below).
11. According to the assessment of legitimate interest the processing of personal data
(weight) serves the purpose of making scooter riding safer. Processing data helps to
reduce the number of accidents happening on the scooters due to tandem riding
(approximately 1000-1200 per season) and collisions with the pedestrians.
12. The result of assessment states that the legitimate interest of the Controller overweighs
the breach of user´s interests.
13. The Controller has established additional protective measures in terms of respective
data processing according to Controller´s in-house information security guidelines that
involve access restrictions; limitation to purpose of use; encryption of data; limited
retention period; availability of additional information from customer support.
14. The Controller has reviewed the details of current complaint and found that it was not
sent in error – the coefficient (based on the data from the accelerator motor about
engine power and forward acceleration) that was calculated from this ride was larger
than the median of previous rides coefficients multiplied by 1.4. In order to minimize
the errors, the Controller has raised the multiplier from 1.4 to 1.5.
Estonian DPI´s opinion:
15. Person´s weight in this case is personal data in the sense of GDPR Article 4 p.1 – an
information relating to an identified or identifiable natural person who can be
identified in particular by reference to an identifier such as one or more factors
specific to the physical, physiological identity of that of natural person. Person´s
weight by itself (not being part of person´s health data for instance) is not considered
sensitive data in the sense of GDPR Article 9.
16. Processing shall be lawful only if and to the extent that at least one of the grounds of
GDPR Article 6 p. a – f apply. The Controller has stated that the legal basis of
processing is legitimate interest (GDPR art. 6(1) p.f) and has presented a legitimate
interest assessment to Estonian DPI.
Data processing serves an important purpose for the scooter users as well as for other
pedestrians – it is aimed to improve the safety of city infrastructure reducing the number
of the accidents resulting from tandem riding and collisions with pedestrians. The
feature helps to educate users and make them aware of the dangers of tandem riding. If
the processing would not take place, the safeguard measures detecting tandem riding
would be lacking. The tandem riding detection is not only a safety-improving feature,
but also a method to align with the requirements set out by cities, as in a range of
European cities tandem riding is legally prohibited. Processing of personal data
(person´s weight) is an essential part of this safety feature. Estonian DPI agrees that
2 (5)
driving simultaneously with another person could be very dangerous both to the people
on the scooter and to other citizens. This could potentially result in heavy injuries or
even death. Currently there are no other effective methods in use that could prevent the
users from tandem riding scooters. Another opportunity would be to install user-facing
cameras on the scooters. Recorded footage could be then analysed to verify how many
people have been riding the scooter. However, this solution would be more excessive as
it would involve constant video surveillance of scooter riders.
Controller has stated that according to their user policy tandem riding is prohibited. In
order to implement this rule and make sure it is being followed by the users, it is
necessary to monitor that users oblige to this. Estonian DPI agrees that when a person
knows that his actions have consequences, the chances that he/she decides to follow the
safety rules are much higher than without any response to this behaviour.
Estonian DPI finds that processing person´s weight does mean that a certain intrusion
to person´s private life is taking place. Although person´s weight here is not considered
to be sensitive data in the sense of GDPR Article 9, some people might still find it
disturbing. It can be taken into account that the data collected does not indicate to
person´s exact weight but the overall weight of the person(s) and objects (e.g. bag) on
the scooter. Notifications do not result in any automated action such as blocking the user
on the platform. Their primary goal is to educate the users and to prevent the incidents
involving scooters from happening. The warning message is sent only when the
difference in mass is large and the message does not bring any other consequences to
the user. In addition to that is using different protective measures in order to ensure
that the processing and data subject´s rights are being followed. The purpose of this
process is keeping riders and other citizens safe, so taking everything into consideration,
this goal overweighs the intrusion of privacy.
Processing is necessary for the purposes of the legitimate interests pursued by
the Controller, except where such interests are overridden by the interests or
fundamental rights and freedoms of the data subject which require protection of personal
data. Estonian DPI finds that the interests of the Controller serve an important purpose
– safety of people. The proposed method of processing is not too intrusive taking into
consideratsion other possible options for achieving the same purpose (e.g. video
surveillance). Taking into consideration that tandem riding is prohibited by the
Controller, the data subject can reasonably expect that the Controller has the right to
check if Terms and Conditions are being followed, the breach of interests is not
excessive. Nevertheless, the processing does envolve monitoring the changes in
person´s body mass and this might present some concerns to the data subject, However,
taking into consideration that it does serve a better purpose and consequently does not
bring any binding effects to the users, the interests of the Controller overweigh the
interests of the data subject. Estonian DPI finds that necessary aspects in order to be
able to rely on legitimate interest as a legal basis of processing are filled - the interests
or the fundamental rights and freedoms of the data subject are not overridden and
therefore agrees that the processing can be based on legitimate interest - GDPR art. 6
(1) p.f.
17. GDPR Article 22 (1) states that the data subject shall have the right not to be subject
to a decision based solely on automated processing, including profiling, which
produces legal effects concerning him or her or similarly significantly affects him or
her. It is followed by an expert´s comment that says: The applicability of this article is
limited to automated data processing where the decisions have a big impact on data
subjects.1 The processing does not envolve decision making that would produce legal
1
https://gdpr-text.com/et/read/article-22/#comment_gdpr-a-22_1
3 (5)
effects to the data subject or similarly significantly affect them. For the data subject,
the outcome of the processing is to receive a notification message that doesn´t involve
any further restrictions or obligations. Consequently no binding decisions are being
made during the processing.
18. According to GDPR Art 13 (1) where personal data relating to a data subject are
collected from the data subject, the controller shall, at the time when personal data are
obtained, provide the data subject with the following information: p. c - the purposes
of the processing for which the personal data are intended as well as the legal basis for
the processing; p. d - where the processing is based on point (f) of Article 6(1), the
legitimate interests pursued by the controller or by a third party. And according to
GDPR Art 13 (2) p. a - the period for which the personal data will be stored, or if that
is not possible, the criteria used to determine that period.
19. At the moment Controller´s Privacy Policy does not include the necessary information
stated in GDPR Art. 13 regarding personal data processing.
20. Therefore Estonian DPI has proposed that the Controller updates their Privacy Policy
with the necessary information that will be presented in a concise, transparent,
intelligible and easily accessible manner, using clear and plain language as per GDPR
article 12(1).
21. has suggested that they will make necessary changes and will add the following
information to their Privacy Policy:
- Personal data we process: Data collected from the accelerometer like driving speed,
motor force, information about riding style (e.g sudden stopping or sliding), the whole
weight of the objects and person (s), the change of weight.
- Purpose of the processing: When you use ´s rental devices, we process the data
received through the accelerometer for safety purposes in order to detect a potentially
dangerous driving style and will send a notification to the data subject if a dangerous
driving style has been detected – e.g the whole weight of the load has changed
significantly since the last ride. It does not cause any binding consequences to the user
and it´s purpose is to secure a safe way of driving.
- Legal basis: Our legitimate interests also include things like investigating and
detecting fraudulent payments and other malicious activities, maintaining the security
of our network and systems, and responding to suspected or actual criminal acts and
maintaining the implementation and preservation of our securing safety functions.
- Retention: the data collected from the accelerometer will be stored for 6 months.
22 will complete and update the changes in Privacy Policy in the languages that
tandem riding prevention feature concerns.
23. Finnish SA has shared an opinion that it would be considered as a good practice if the
Controller informs the data subjects about processing their personal data upon sending
the warning message which informs about the detected possible tandem riding. In
Finnish SA´s opinion this could be done e.g. by adding a link to the privacy policy
into the message. Estonian DPI has asked the Controller to add a link to the message
and they agreed to do so.
24. According to Estonian law it is not possible to issue an administrative fine based on a
breach of GDPR. Penalizing is possible through misdemeanour procedure, however,
we do not find that the elements for starting this process are present in this case.
4 (5)
Conclusion
The Controller processes data subject´s weight in order to prevent tandem riding and enforce
safer driving style. The legal basis of processing the data is GDPR art 6 (1) p f – legitimate
interest. Even if this processing involves monitoring the changes of the person´s weight, this
data will be used to enforce safe driving and it will overbalance the privacy intrusion. The data
will be saved for a limited period of time in a secure way and will only be used in order to
launch the notification message to the user when possible tandem riding has been detected. The
processing is necessary in order to ensure safety of ´s customers as well as of other
pedestrians. will update their Privacy Policy in 60 days with the necessary information
regarding the processing of person´s weight so that the data subjects will have a transparent
overview of data processing. In addition to that will add a link about tandem riding function
to the warning message sent to the user.
To conclude, SA Estonia will issue a reprimand (GDPR art 58 (2) p b) to the Controller
because processing operations have infringed provisions of GDPR art 13 (1) p c, d and art
13 (2) p a and will terminate the proceedings concerning the protection of personal data
regarding .
Best regards
Lawyer
authorized by Director General
5 (5)