ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
Ours: 04.10.2023 nr 2.1.-1/23/103
Final Decision
Estonian Data Protection Authority (hereinafter Estonian DPA) received a complaint from
citizen of Latvia regarding the storage of his personal data by
. According to the complaint, the complainant deleted his account (in the
application) on 20 December 2022. The following day, the complainant created a new account
and succeeded, but was unable to validate his driving licence and the Helpdesk explained
to him that the driving licence was linked to another account. According to the explanations
provided by the Helpdesk, the driving licence will be removed from the old account after
10 days. The complainant also deleted a new account on 09.01.2023. The complainant made a
new account for using the same data as before and tried to confirm his driving licence
again, but this was not successful and, according to the explanations provided by the customer
support, the driving licence was linked to another account. Customer support asked to wait 3-4
days. The complainant contacted the customer support again on 13 January 2023, but he was
no longer answered.
Pursuant to Article 5(1)(e) of the GDPR, personal data are to be retained in a form which permits
identification of data subjects only for as long as is necessary for the purpose for which the
personal data are processed (‘storage restriction’). ’s privacy
policy states that the data will only be stored for as long as necessary for the purposes described
above. This means that we retain different categories of data for different periods of time
depending on the type of data, the related service and the purposes for which we collected the
data. Your data will be kept for as long as you have an active account. If your account is closed,
we will delete your data (in accordance with our data retention schedule and policies) unless
this information is necessary to comply with legal obligations or for accounting, dispute
resolution or fraud prevention purposes.
Estonian DPA started the procedure for the designation of the lead supervisory authority under
Article 56 of the GDPR. Since is a company operating in Estonia the Data
Protection Inspectorate is the lead supervisory authority which conducted the supervision
procedure.
Estonian DPA made an inquiry to , to which they replied as follows:
1. According to ’s Privacy Notice, user data will be deleted unless it is necessary
to comply with legal obligations or for accounting, dispute resolution or fraud
prevention purposes. In this case, the data will be retained on the following legal bases:
— Article 6(1)(c) of the GDPR – where the data is necessary for compliance with legal
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
obligations (including accounting obligations); and – Article 6(1)(f) of the GDPR –
when the data is processed for the resolution of disputes or the prevention of fraud.
2. This retention schedule for the Car Sharing Service and the processing
operations are set out in the Privacy Notice, which is available on the
“Legal” tab. The privacy notice for Estonian residents is available and a notice
for residents of Latvia .
According to this Privacy Notice, the User’s data will be stored for as long as he/she
has an active account. If the account is closed, the user’s data shall be deleted unless
such data is required for the following purposes: to comply with legal obligations or for
accounting, dispute resolution or fraud prevention purposes.
3. The main reason for the misunderstanding is the fact that several accounts were
registered and deleted by the data subject within a short period of time (i.e. between 20
December 2022 and 9 January 2023) and that each time the data subject’s requests
(linked to the new account) were handled by different staff. The reason why the data
subject’s request was handled each time by a different employee was that each time the
data subject deleted/registered a new account and contacted ’s support team, it
created a new so-called ticket (tickets, angel ticket, used to share ’s internal tasks)
in ’s systems to the customer support team. As all accounts were “new”
accounts, unfortunately, customer support tickets were not interlinked, which meant that
the data subject was in contact with many customer support staff. has a system that
supports the deletion of accounts, but this is not an immediate process. deletes the
account from the user’s view immediately, but internal processing of the application
takes up to 10 days. Until the complete account deletion is carried out within , the
user cannot verify himself/herself with the new account, as his/her data may still be
registered in ’s internal systems until the process of fulfilling the deletion request
has yet been completed. This led to a misunderstanding as the data subject tried to
create new accounts too quickly after each account was deleted. Thus, all accounts
created by the data subject (a total of 4 previous accounts) have been deleted and the
data subject has successfully completed the verification of his current account driving
licence on 6.2.2023. provides a comprehensive response to the data subject in order
to resolve the confusion that has arisen and to clarify the situation.
Estonian DPA finds that in this case there was a human error and misunderstanding that was
caused partially by the complainant, since he registered himself as a user and deleted the user
within short periods. Since, in practice, deletes driving licence information from the
system within a reasonable period of time, the Estonian DPA does not see any violation in this
case. Since the complainant’s personal data has been deleted by the controller according to the
request in a timely manner and the controller has given information regarding the deletion of
complainant’s personal data, the data processor has met the obligations arising from GDPR Art
17 and Art 12 (3). SA Estonia did not detect any GDPR violations since the situation was caused
by a human error mainly because of a misunderstanding and therefore SA Estonia must end the
proceedings.
Based on the above, SA Estonia did not detect any violation of data subject’s rights and
therefore will terminate the proceedings concerning the protection of personal data by
.
Best regards
Estonian DPA
2 (2)