ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Notation made: 27.01.2023
The access restriction shall be valid until the entry into
force of the decision
Base: AvTS § 35 lg 1 p 2
unofficial translation
Our: 27.01.2023 nr 2.1.-1/23/3178-
15
Article 60 - Final Decision
Notice of termination of the proceedings concerning the protection of personal data
SA Poland forwarded to Estonian SA a complaint, in which the complainant stated that he
found his personal data on a website selling debts and his data should not be visible on the
website . The controller of that website is which is
established in Estonia.
Based on the information, Estonian SA started official proceedings regarding the case. We
forwarded to the data controller our questions regarding the situation and explained under
which circumstances personal data can be processed, referring to GDPR Art. 6(1)(f). The data
controller provided explanations and legitimate interest assessment. In the data controller
opinion it was legitimate to disclose for everyone debtor's total value of debt, name, surname
and address, indicating the city and street name, but without the real estate number and the
number of the apartment. During an investigation the data controller also several times
referred to different opinions of the Polish General Inspector for the Protection of Personal
Data and court decisions, claiming that the disclosure of such scope of debtor's data is lawful
and it`s common practice in Poland.
In Estonian Data Protection Inspectorate opinion it is lawful to process personal data for the
performance of a contract but the disclosure of such scope of debtor's data on website is not
necessary for the performance of a contract and for that controller should have some other
legal basis. In our opinion and according to our practice, the basis for the legitimate interests
assessment for this purpose is also not met, because findability of debtor's data in a search
engines excessively harms the privacy of persons and embarrass them. In Estonia debtors'
data on such websites is available only to logged-in users who identify themselves and they
also have to confirm that they have legitimate interest to see debtor's data. Therefore, Estonian
Data Protection Inspectorate decided to consult to Poland SA. The purpose was to find out
whether such disclosure of data is in accordance with the principle of "data minimization" of
the GDPR in Polish SA opinion and whether it is common practice in Poland.
In the opinion of the Poland SA, the disclosure of debtor’s personal data on the websites
operating the debt exchanges is permissible under the rules on the protection of personal data.
In the view of the Poland SA, such processing operation could be based on Art. 6(1)(f)
GDPR, since the debtor must expect that, by delaying the performance of an obligation, his
right to privacy may be restricted by the recovery by the creditor of the sums owed to it.
Otherwise, the debtor, invoking the right to protection of personal data, would effectively
evade its obligation to pay the debt and consequently restrict the creditor’s right to obtain the
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
due payment. The right to privacy would also limit the special provisions which provide the
right to sell the debt and to take further actions in order to retrieve it.
Poland SA also stated that in their opinion publication of debt information in relation to the
debtor’s personal data is necessary for the purpose of selling the claim and the disclosure on a
website of the debtor’s personal data as regards his name and street and locality, but without
the real estate number and the amount of the debt is in line with the principle of data
minimisation under Article 5 GDPR. The disclosure of the debtor’s personal data on the
website as regards his name, street name, locality and debt data to a limited extent, i.e. the
value of the gross claim and the period of its past due date, was also considered to be lawful.
This data was available to all users of the service on the same basis.
Moreover, Poland SA also referred to The Supreme Administrative Court`s decision (February
2014, ref. I OSK 2463/12), in which court stated that, in such a situation, reliance on the
protection of privacy, loss of reputation and humiliation in public reception did not allow the
conclusion that the rights and freedoms of the debtor had been infringed. The court
emphasised that the debtor must expect that if he is late in performing his obligation, his right
to privacy may be restricted by the creditor’s claims.
Insofar as the data controller processes personal data of a Polish residents and its activities are
aimed only at the Polish market, Estonian Data Protection Inspectorate considers that in this
case it would be excessive interference in business and freedom of competition if the
inspectorate prohibits the data controller's activities (disclosure) in a situation where this is a
common practice in Poland. Therefore we have decided to terminate the proceedings.
Respectfully,
(signed digitally)
lawyer
authorized by Director General
2 (2)