BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
9 June 2023
Final Decision
Complaint against
Transparency of processing (Article 15 DS-GVO)
IMI-Reference: A56ID: 359879 – Case Register: 438384
Our ref.: LDA-1085.1-7679/21-W
AEPD ref.: EXP202200879
The Data Protection Authority of Bavaria for the Private Sector (hereinafter “BayLDA”) refers to the com-
plaint of (hereinafter „the complainant“)
against (hereinafter „the respondent“)
1. Preliminary remarks
The complaint was lodged with the BayLDA in July 2021. It was transmitted to the Spanish supervisory
authority – the lead supervisory authority (LSA) for the cross-border processing conducted by
– in accordance with Article 56 GDPR. The lead supervisory authority
carried out the investigation and proposed in its draft decision to close the case.
In accordance with Article 60(8) GDPR, the BayLDA, as the supervisory authority with which the com-
plaint has been lodged, adopts the decision in the form agreed in the cooperation procedure and pro-
vides the following information:
2. Summary of the case
2.1. Facts
On 12 July 2021, the complainant, represented by , lodged a complaint with the
BayLDA. The complaint was directed against the
, for failure to provide access. The grounds for the complaint are as follows:
The complainant, who is an , received a call on his corporate
mobile phone on 22 February 2021 concerning services provided by . During the call,
he was told that he was contacted on the basis of the agency of a former board member of the em-
ployer. On the same day, he received a message from at his corporate email address.
On the following day (23 February 2021), the complainant replied to the email asking for information on
the origin of the data concerning him. Having received no reply, he sought information on the origin of
his data on 15 April 2021, now via his legal representative by letter (without proof of delivery). The dead-
line set by the legal representative for providing information (29 April 2021) expired without any reac-
tion from .
...
-2-
The following documents were attached to the complaint:
Screenshot of the email of 22 February 2021 from to (email
address of the complainant), in which it was stated that they are looking forward to providing him
further information on the GOLD TO GO AG project.
Copy of the letter of 14 April 2021 to
. In that letter, the appellant’s legal representative requests, inter alia, access under
Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
(‘GDPR’).
Copy of a power of attorney signed by the complainant on 14 September 2021 in favour of
, which includes, inter alia, representation of the complainant in out-of-court pro-
ceedings.
File memo of the BayLDA of 18 January 2022 summarising its research on the domain
. The research shows that the website cannot be accessed. According to a domain query
at
the domain was not registered.
By means of a Google search the website
was found, which contained a total of 13 entries of the domain in its privacy policy.
The website’s imprint refers to the
2.2. Lead Supervisory Authority
Through the ‘Internal Market Information System’ (‘IMI’), governed by Regulation (EU) No 1024/2012 of
the European Parliament and of the Council of 25 October 2012 (‘the IMI Regulation’), intended to pro-
mote cross-border administrative cooperation, mutual assistance between Member States and the ex-
change of information, the complaint was forwarded on 25 January 2022 and registered with the
Spanish Data Protection Authority (AEPD) on 26 January 2022. This complaint has been forwarded to the
AEPD in accordance with Article 56 GDPR, taking into account the cross-border nature of the complaint
and the power of the AEPD to act as lead supervisor because the
has its statutory seat and its sole establishment in Spain.
Under Article 60, the BayLDA acts as a supervisory authority concerned (Article 4(22)(c) of the GDPR)
with which the complaint was lodged without other supervisory authorities having declared themselves
to be concerned by the complaint.
On 21 June 2022, the AEPD received the complainant’s complaint under Article 64(3) of ‘Spanish Organic
Law No 3/2018 of 5 December on the protection of personal data and guarantee of digital rights
(LOPDGDD)’, the complaint lodged by the complainant was declared admissible.
2.3. Investigation by the Spanish Supervisory Authority
On 24 June 2021, the historical registry of the domain was consulted and
the following information was obtained:
Between 27 August 2020 and 21 September 2021, the domain name server be-
longed to the domain name .
Reply from received by the AEPD on 4 June 2022: owned
the domain from the date of its registration until its withdrawal date on 25 August
2021
On 29 August 2022, the data of was viewed in the cen-
tral commercial register (on its website http://www.rmc.es/sociedadesInscritas/NombreSocial.aspx),
-3-
including the following information:
The sole manager of is .
Reply from , received by AEPD on 7 September 2022:
a) Statement that neither the complainant’s data nor his call is registered in its customer data base.
b) Statement that they sometimes call people recommended by their clients, but they do not have a
footballer as a client who is working for the same club for which the complainant works and they
have not found a customer who is aware of the complainant’s club affiliation.
c) Statement that they have a protocol for responding to data protection requests and the exercise of
data protections rights but that they are not aware of having received any request from the com-
plainant or his lawyer.
d) Statement that a refresher course for data protection rights with its Data Protection
Officer has taken place in the company.
e) Statement that a series of measures will be put in place by the end of 2022 that may prevent simi-
lar events from occurring, such as contracting a service to record calls (caller, recipient, date, time and
duration), recording of the request for consent at the start of calls in cases where someone is called
as recommended by a customer who is not yet a client, installing a CRM (Customer Relationship
Management) system clearly indicating whether a customer wishes to receive commercial infor-
mation.
f) Statement that the incident may have been caused by a forging of the identity of the controller or
by an incorrect call from an employee.
g) Statement that the complainant will be contacted in order to find out who called him and to clarify
the facts.
2.4. Aspects for the assessment of a sanction
Duration of the possible infringement: the complainant would have requested access to his personal
data, which would not have been contested by .
Number of data subjects affected by the possible infringement: one.
Total worldwide annual turnover: Having consulted the company’s data at
service on 15 September 2022, it appears that it is an ‘autonomous’ company with a num-
ber of employees of and a sales volume of .
Any relevant previous infringement by the controller of the same nature as the facts in question:
There is no evidence that proceedings for infringements by
have been resolved in the last year.
Nature and amount of the damage suffered by data subjects: they are not visible.
has spontaneously recognised his guilt: No.
Link between the activity of the undertaking under investigation and the processing of personal data:
it is a legal person not accustomed to the processing of personal data.
-4-
2.5. Legal assessment by the Spanish Supervisory Authority
Competence and applicable law:
In accordance with Article 60 (8) of the GDPR and in accordance with Article 47 and 48 of the LOPDGDD,
the Director of the Spanish Data Protection Agency is competent to decide on these investigative ac-
tions. In addition, Article 63 (2) of the LOPDGDD states that: The procedures handled by the Spanish
Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, of this organic
law, by the regulatory provisions dictated in their development and, insofar as they are not contradicted,
alternatively, by the general rules on administrative procedures.’
processed person data in accordance with Article 4(1) and
4(2) of the GDPR, since it collects and stores, inter alia, the following personal data of natural persons:
first name, last name, e-mail and telephone, among other processing.
is controller for this processing, since it determines the pur-
poses and means of the processing pursuant to Article 4(7) of the GDPR. Furthermore, the processing
constitutes cross-border processing, as is established in
Spain, and provides its services in other countries of the European Union.
The GDPR provides, in Article 56(1), for cases of cross-border processing, as provided for in Article 4
(23), in relation to the competence of the lead supervisory authority that, without prejudice to Article 55,
the supervisory authority of the main establishment or the single establishment of the controller or pro-
cessor shall be competent to act as lead supervisory authority for cross-border processing carried out by
that controller or processor in accordance with the procedure set out in Article 60. In the case under
consideration, as explained above, has its sole establishment in
Spain, so the Spanish Data Protection Agency is therefore competent to act as the lead supervisory au-
thority.
Article 15 of the GDPR governs the ‘Right of access by the data subject’:
In the case at hand, the complainant complained that he had received a telephone call and an email
from After receiving this email, he said that he had re-
quested access to his personal data by email. In the absence of a reply, he states that he sent a letter, via
a legal representative, in which he again requested access to his personal data.
However, the complainant has not provided the email requesting such access to the respondent. Fur-
thermore, regarding the letter sent by his legal representative, the letter was sent as a normal letter
without proof of delivery, so its receipt by is not docu-
mented.
The respondent has stated that it has not received any of these documents from the complainant re-
questing access.
Therefore, on the basis of the previous paragraphs, no evidence has been found to prove the existence
of an infringement within the scope of the Spanish Data Protection Agency, since the right of access has
not been exercised by means that made it possible to establish that
received it.
Measure proposed by the Spanish Supervisory Authority:
On the basis of the complaint received via the IMI system and by considering the facts and legal provi-
sions mentioned herein, the Spanish Supervisory Authority proposes to close the proceedings against
.
In the case at hand the procedure pursuant to Art. 60(8) of the GDPR is to be followed.
-5-
3. Decision
In our final examination of the complaint lodged by , represented by
, concerning the failure to provide access by we found
no demonstrable infringement of Article 15 of the GDPR.
The complaint is therefore dismissed and the proceedings are closed.
Bayerisches Landesamt für Datenschutzaufsicht