ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
INTERNAL INFORMATION
Information holder: Estonian Data Protection
Inspectorate
Date: 11.10.2023
Valid until: 11.10.2098
Legal ground: Public Information Act § 35 (1) p.2,
p.12
ARTICLE 60 FINAL DECISION
Notice of termination of the proceedings concerning the protection of personal data
Estonian Data Protection Inspecorate received two complaints through European Commissions
Internal Market Information System (IMI) from Spanish SA. The controller –
has its main establishment in Tallinn, Estonia. Estonian DPI has accepted the case
as LSA.
THE COURSE OF PROCEEDINGS
The complaints
1. According to the complaints the complainants’ personal data has been registered into a
Spanish insolvency file (ASNEF) regarding a debt that they were not been notified of. In
addition, the complainants have not received any kind of explanation about the way it has been
generated, they were not notified prior to registration and after and they have not received a
response when they exercised their right of access and deletion.
Controller explanations
2. Estonian DPI initiated a supervision proceeding on the basis of clause 56 (3) 8) of the
Personal Data Protection Act. Estonian DPI contacted the Controller to clarify if complainants
were notified, have they received a response from the controller and what is the purpose and
legal basis of processing personal data.
3. Estonia DPI sent the first inquiry with a proposition to restrict the processing of personal data
on 15.11.2022. replied on 26.11.2022 (registered in DPI-s system 28.11.2022) but did
not agree with the proposition. Explanations transmitted by regarding the first inquiry:
3.1. Estonian DPI: On what legal basis and for which purpose do you process the
personal data of the complainants? Communicate the contracts concluded with the
complainants.
processes the data of the persons mentioned in the inquiry for the purpose of
performing the loan agreements concluded with the persons pursuant to the Article 6(1)(b) of
GDPR.
The contracts have been concluded as follows:
(Client No ) loan agreement No
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
, signed 25.10.2019 (Annex 1) and Loan Agreement No signed on
08.07.2019 (Annex 2).
(Client No ) Loan Agreement No ,
signed on 05.02.2019 (Annex 3)
3.2. Estonian DPI: Have you forwarded the claimants’ debt data to the Asociación
Nacional de Establecimientos Financieros de Crédito (ASNEF)? If you have
transmitted, please indicate the legal basis and purpose of the transfer.
’s arrears information has been sent to ASNEF
27.03.2020 and 21.02.2020 (Annex 8)
Information on the arrears of has been forwarded to ASNEF on
09.08.2019 and 05.07.2019. (Annex 9).
We transmit the debt data pursuant to Article 20 of Ley Orgánica 3/2018, de 5 de diciembre,
de Protección de Datos Personales y garantía de los derechos digitales and Article 6(1)(f) of
the GDPR.
3.3. Estonian DPI: What are the documents proving the payment defaults of the
claimants? Have the complainants received the above-mentioned documents?
The complainants have been informed on several occasions about payment deadlines and
installments not paid by the due date. Annexes 4 and 5 annexed to this reply reflect an excerpt
of the frequency of notifications and reminders sent to the appellants by sms, e-mail and
telephone.
3.4. Estonian DPI: How did assess the accuracy of the debt data before
transmission to the payment default register?
processes debt data automatically and debt notifications are sent to a person
regularly. The Customer will be informed of the incoming obligation 7 days before the due date
and after becoming indebted, debtors will be notified every 5 days via sms, e-mail and
automatic call about arrears. In addition, debt case handlers also contact clients on a daily
basis, informing the client of the obligation to pay the debt and wishing to enter into an
agreement on the payment of the debt. An extract is attached to Annexes 4 and 5 to this reply
as regards the dates of transmission of incoming and incoming debt notifications and the
notification channel.
3.5. Estonian DPI: How have complainants been informed of ’s right to
transmit and the actual transmission? If you have notified, please provide
supporting documents for the notification.
When entering into a loan agreement, the data subject can read the privacy policy on ’s
website. In accordance with Section 10.4.4 of the Privacy Policy, the data subject is informed
about the transfer of arrears arising from a contractual obligation to a payment default
company. Clause 13.1 of the loan agreement also sets out the lender’s rights in the event of
payment defaults.
Complainants have been informed of the possibility of recovering the debt through the court in
the event of non-payment, and the publication of the debt in the ASNEF-Equifax register of
2 (11)
defaults if 30 days have passed from the breach of the contract in the notice of debt.
The complainants have also been offered the possibility to extend the payment schedule or to
apply for an extension of the loan amount. An excerpt of ’s rights in respect of the debt
owed to the complainants is reflected in Annexes 6 and 7 to this reply. Annexes 6.1 and 7.1
contain a notification by ASNEF-Equifax that the complainants debt information has been
entered into the payment default information system.
3.6. Estonian DPI: Why has not responded to the complainants’ requests? If a
reply has been received, please also forward a copy of the reply to the Inspectorate.
To our knowledge, the complainants have not submitted applications directly to , but
have reached us via ASNAF-Equifax. For its part, has responded to all customer
complaints submitted by ASNAF-Equifax. Replies to complaints are annexed to Annexes 10 and
11 to this reply and their sub-Annexes.
By letter No 2.1.-1/22/2597 of 15 November 2022, you propose to to restrict the
processing of the complainants’ personal data for the duration of the present proceedings in
accordance with Article 18(1)(a) of the GDPR.
considers it necessary to clarify that we have a legitimate interest in disclosing debt
information with Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF),
which manages the payment default, with the legitimate interest of other credit institutions and
the legal obligation to verify the borrower’s creditworthiness. For our part, we have made
every effort to extend the payment schedule to the complainants and to respond to all complaints
submitted by the complainants regarding the processing of personal data.
4. Estonian DPI repeated the proposition on 29.11.2022 and requested that controller forwards
the requested documents to the complainants. answered on 12.12.2022 and did not
agree with the proposition because complainants have still have debts, the data is accurate, and
processing is lawful. stated the following:
Pursuant to Article 18(1)(a), the data subject has the right to request the controller to restrict
the processing of personal data if the data subject contests the accuracy of the personal data
for a period which enables the controller to verify the accuracy of the personal data.
Since the complainants are still in debt to and has repeatedly informed the
complainants of the right to forward data, in addition to the provisions of the Agreement (clause
13.1), the complainants have no reason to demand that the transmission of notices related to
the payment default be restricted on the grounds set out in the Agreement.
considers it necessary to clarify that in the case of
, the arrears information has been forwarded to the court in the framework of the
expedited payment order procedure on 29.08.2019 and the judgment in favour of was
delivered on 28.01.2020 has been identified
and paid due to the loan agreements and the payment schedule.
Based on the above, we find that has verified the accuracy of the personal data and
does not consider it justified to restrict the processing of personal data. At the moment, there is
no reason to believe that the data is incorrect and therefore we consider that has a
legal basis to disclose debt information to Asociación Nacional de Establecimientos
Financieros de Crédito (ASNEF), which manages the payment defaults, on the basis of the
3 (11)
legitimate interest of other credit institutions and the credit institution’s legal obligation to
verify the borrower’s creditworthiness.
We also inform you that, by means of this reply, we will forward the documentation requested
by the complainant, (Annex 2). In the context
of this inquiry and proposal, did not provide the complainant with the documents
requested by , since it was not possible to identify him on the basis of a copy of the
document annexed to the application previously forwarded to . Pursuant to Article
12(6) of the IKÜM, has asked the complainant for further information on his identity,
but the complainant has not yet responded to the request (Annex 3).
Additional inquiries
5. Spanish SA raised concerns: why did reply to complainants’ requests two months
later; is there evidence that the documentation was sent to the complainants; is there evidence
that the complainants have received the documentation and notifications; why did send
the requested documents to an email address which was not marked as a contact in loan
agreements.
6. Estonian DPI requested further information on 05.04.2023 on how the documents were
forwarded to the complainants and why they were sent to an email address, if complainants sent
their requests by mail, and proof that the complainants have received notifications from
. stated on 19.04.2023 the following:
6.1. Estonian DPI: How has received the complainants’ email addresses?
The prerequisite for submitting a loan application and entering into a loan agreement is that
in order to use the services provided by the lender, the person must register as a user of the
portal. In order to use the portal, the person must register his or her e-mail address on the
website and, in order to confirm it, the person must log in to the portal using the
temporary password created by the portal. Creating an account requires entering a valid e-
mail address and password, after which the customer is verified through the e-mail address
provided. The e-mail address provided by the customer is also used as a communication
channel for communication with the customer.
6.2. Estonian DPI: Explain why notices of publication in the payment default register
have been sent to the complainants by e-mail when the initial request for submission
of documents has been sent by ordinary mail?
sends information to customers via e-mail, sms, phone calls and regular mail if the
respective contact details have been provided to during the conclusion of the loan
agreement. It is apparent from Annexes 6.1.1 to 6.1.3 of the reply sent by to the Data
Protection Inspectorate on 27.11.2022 that has sent notices to
by regular mail to the address provided by the complainant in the course of the
conclusion of the loan agreement in the payment default register on 24.10.2019 and two notices
of 05.02.2020 respectively. Notification of publication in the payment default register submitted
to on 20.06.2019 (Annexes 2, 3, 8, 9 and 10 to this reply).
In that regard, it should be noted that, in addition to the requests for transmission of data
transmitted by the complainants by ordinary mail ( ,
(14.7.2022, received on 26 July 2022) (04 May
2020, received on 11 May 2022), the complainants have also repeatedly submitted
requests for data transmission via the ASNEF/EQUIFAX payment default register, in which
they request information electronically (to the email address [email protected]) and
4 (11)
not to send information by ordinary mail. (Annex 4).
6.3. Estonian DPI: Please provide evidence that the complainants have received the
notifications sent through the information portal in relation to publication in the
payment default register.
The Client is obligated to inform the Lender immediately, but not later than within five (5)
business days, of any circumstances affecting or likely to affect the User’s ability to perform
the obligations arising from the agreements concluded between the Lender and the User, in
particular the Loan Agreements, in accordance with clause 5.1.3 of the Terms of Use of
.
In addition, Clause 3 of the Loan Agreement specifies the CONTRACTING CONDITIONS of
the Borrower in sub-item 3.1 The Borrower shall immediately inform the Lender, but in any
event within five (5) business days; 3.1.1 changes in the data and/or documents submitted to
the Lender, including changes in the borrower’s personal and contact details, work,
obligations, assets and/or income.
As neither of the Complainants has submitted a request to change their contact details, we are
of the opinion that the Complainants are aware that communication between the parties will
take place in accordance with the contact details provided. This is also confirmed by the fact
that both persons have logged in to ’s account with an e-mail address registered in the
Portal even after the debt notices and have been informed about what is happening in their
account (including debt information). The log extracts are Annexes 5 and 6 respectively to this
reply. In addition, we send the extracts of the notices for forwarding information to the payment
default register via ASNEF/Equifax:
: 13.06.2022 and 23.11.2022. (Annexes 2 and 3)
: 05.02.2020 two notifications and 24.10.2019
(Annexes 8, 9 and 10)
6.4. Estonian DPI: Please forward to the Supervision Authority evidence that the
documents submitted (loan agreements, notifications) have been served on the
complainants.
An extract from the file transmitted to on 09.12.2022
is set out in Annex 7 to this reply.
has received debt notifications by sms, e-mail and regular
mail, but since the person has not responded to a request for identification, the response
documentation for the request has been forwarded to the Data Protection Inspectorate in Annex
2 to the reply on 12.12.2022.
6.5. Estonian DPI: Please explain why the request for information sent by
on 04.05.2022 was answered two months later
(04.07.2022).
Since the complainant had submitted a request for the removal of similar debt information
published in the payment default register on 13.05.2022 via ASNEF/Equifax, which was also
executed on 24.05.2022, the employee considered the request submitted via both the mail and
the payment default register to be fulfilled and, due to human error, did not immediately submit
additional documents to the complainant. The extract with the notation of the removal of debt
information from the payment default register was appended to Annex 11 to the reply sent to
the Supervision Authority on 27.11.2022.
7. sent additional information on 02.05.2023. Their answers are following:
5 (11)
In addition, we provide additional extracts to this reply concerning the communication
concerning .
According to paragraph 2 of ’s reply of 19.04.2023, the complainant’s request,
forwarded on 14 July 2022, was received by on 26.07.2022, to which replied
on 08.08.2022. A screenshot of the submitted reply together with the files transmitted with the
reply (Annex 1) is attached to this reply.
In our reply of 19.04.2023, we mentioned that both complainants have repeatedly submitted
applications for payment defaults via the ASNEF/Equifax payment default register. The replies
to the request submitted on 10.11.2022 are annexed to this letter (Annexes 3 and 4). As the
complainant wishes to forward information to a third party in its request and it was not possible
to identify the person on the basis of a copy of the document annexed to the application, we
requested the complainant to forward a copy of the identification document (Annex 5) on 05
and 06.12.2022. Since the complainant states in its statement that it is unaware of its debt and
its origin, has allegedly never contacted , we also attach to this reply
a statement of notifications that reflects the information provided to the Appellant and its
frequency by SMS, telephone, e-mail and regular mail. The extract is accompanied in part by
Estonian translations which, through the extract, have similar content (Annex 6).
In order to clear if has sent the requested documentation to
and what notifications they send to data subjects, Estonian DPI made
an additional inquiry on 09.06.2023. replied on 12.06.2023, and explained that
Documents were forwarded to by on 04.07.2022 and
09.12.2022. Documents have been forwarded to on 08.08.2022.
On 10.11.2022, the person requested: the transfer of data to a third party, however, the identity
document attached to the application is not allowed to identify the person. ’s repeated
requests for identity information, the person hasn't reacted. 10.11.2022 The documentation
requested by the person is for the Data Protection Inspectorate Submitted by on
12.12.2022.
does not make separate notifications to debtors after their data has been transmitted
to the default register. When submitting a debt notification, informs the debtors of the
deadline by which, in the event of non-payment of the debt, the information transmitted to the
register of payment defaults. Reply sent by to the Data Protection Inspectorate
02.05.2023 Annex 4.3 The translation file for the ASNEF notification shows that the content of
the notification is as follows: If you don't pay the debt 15 during the day, we are obligated to:
1. Disclose your debt in the Spanish default register ASNEF/EQUIFAX Ibérica S.L.,...’
Estonian DPI also requested documents regarding
s contract and login logs to ’s website. replied on 26.07.2023
and attached requested documents.
ESTONIAN DATA PROTECTION INSPECTORATE’S OPINION
Legal basis for processing personal data
8. Pursuant to Article 6 (1)(a) of GDPR processing shall be lawful only if and to the extent that
at least one of the legal bases stated in article 6 (1) applies. stated in their inquiry
1
response on 28.11.2022 that the legal basis for processing complainants’ personal data falls
under Article 6 (1)(b) of GDPR.
9. The Estonian Data Protection Inspectorate explains that regarding processing of personal
1
Sent to DPI on 26.11.2022. Registred in Estonian DPI-s documentation system 28.11.2022.
6 (11)
data, it only assesses whether the transmission of personal data has been lawful, not the
lawfulness of the debt claim. The Estonian Data Protection Inspectorate does not have the
competence to assess whether the contracts are valid lawfully, what the claims consist of,
whether the debt has actually been liquidated, whether or not the rules for the assignment of the
claim have been complied with, as those are disputes that arise from contractual relations.
Settlement of contractual disputes between private parties is a matter for the civil court.
10. stated that both complainants have loan agreements with . Loan
agreements have been sent to Estonian DPI as well. Complainants loan agreements are
following:
- (Client ) loan
agreement , signed 25.10.20192 and Loan Agreement
signed on 08.07.20193.
- (Client ) Loan Agreement
4
, signed on 05.02.2019 .
11. has also sent both complainant’s login information to Estonian DPI which prove
that the complainants were using ’s portal and indeed started loan applications.
Therefore, the complainants had to be aware of the loans and the terms of the loans.
12. Since Spanish SA raised some concerns on why sent emails to complainants if the
email was not listed in loan contract, Estonian DPI requested additional information.
has stated in their reply on 19.04.2023 that in order to get a loan with , the person needs
to register an account on ’s website, and the person will be verified through their email
(5.1. in this draft). Additionally, has sent login logs which prove that the complainants
5
have logged into ’s website. has also provided a log of the payments that the
complainant has paid in 2019.6 Therefore the complainants were using email addresses to log
into ’s website (loan portal) and consequently had to be aware of the debts.
13. Complainants and have conducted loan agreements and due to that has a
legal basis of Article 6 (1)(b) of GDPR to process complainants’ personal data. Processing data
is necessary for the in order to pursue the claim.
Transmitting data to payment default registry
14. According to the contracts’ clause 13.1. shall have a right, in each case pursuant
to the applicable law, to notify the Borrower thereof and send the following information to the
chosen Payment Default Register. In addition, has stated in their answers that they are
transmitting personal data pursuant to Article 20 of Ley Orgánica 3/2018, de 5 de diciembre,
de Protección de Datos Personales y garantía de los derechos digitales Article 20 and Article
6(1)(f) of the GDPR.
15. Article 20 of the Protección de Datos Personales y garantía de los derechos digitales states
that unless proven otherwise, the processing of personal data related to the breach of monetary,
financial or credit obligations by common credit information systems will be presumed lawful
when the following requirements are met: a) That the data has been provided by the creditor or
2
The contracts time stamp on „ 4“ page 23 and login information „ 2“ attached to ’s reply on
27.07.2023.
3
The contracts time stamp on „ 5“ page 23 and login information „ 2“ attached to ’s reply on
27.07.2023.
4
According to ’s reply 28.11.2023 and 19.05.2023 reply Annex „ 5 _ logging
to .png“ of ’s portal log.
5
Login logs in Annex 5 and 6 of ’s reply on 19.04.2023.
6
Annex 2 of ’s reply 12.12.2022 „ 2 Respuesta a su reclamacion (6).zip“
7 (11)
by whoever acts on their behalf or in their interest. b) That the data refer to true, overdue and
enforceable debts, the existence or amount of which has not been the subject of an
administrative or judicial claim by the debtor or through an alternative dispute resolution
procedure binding between the parties. c) That the creditor has informed the affected party in
the contract or at the time of requesting payment about the possibility of inclusion in said
systems, indicating those in which they participate. Estonian DPI assesses the legal basis of
transmission in accordance with GDPR and Protección de Datos Personales y garantía de los
derechos digitales Article 20.
16. Transmitting personal data to a payment default registry on a legal basis of legitimate
interest (Article 6 (1) (f)) requires a balancing test of the controller and the data subjects’
interests or fundamental rights and freedoms. Payment default registry’s purpose is give third
parties (with legal basis) an opportunity to assess the creditworthiness of the data subject and
additionally to protect the data subjects from taking obligations that they may not be able to
fulfil due to payment difficulties. If the data subject has violated their obligations to a third
party (creditor), the creditor may forward debtor’s personal data to the payment default registry.
As mentioned above complainants have logged into ’s portal and do have loan
agreements but have not fulfilled their obligations regarding payments.
17. is a creditor who offers different loans to data subjects. Consequently, ’s
interest is to claim the debts. If the data subject has not fulfilled their obligation and has failed
to make loan payments as a controller has an interest to share that information with
payment default registry.
18. Complainants’ interest is to protect their personal data and to be treated as an equal with
other people who do not have payment difficulties. On the other hand, as GDPR states the right
to the protection of personal data is not an absolute right; it must be considered in relation to its
function in society and be balanced against other fundamental rights, in accordance with the
principle of proportionality. Payment default registry’s purpose is to give third parties an
opportunity to assess the creditworthiness of the data subject and therefore protect transaction
reliability. When the data subject fails to make loan payments, the creditor has a legitimate
interest to transmit personal data to the payment default registry.
19. did inform the complainants about the possibility of transmission of their personal
data to a payment default registry in contract clause 13.1. and later in their reminders regarding
the payments. Estonian DPI has no knowledge if the complainants have issued a court case
regarding the loans. Estonian DPI does not assess Spanish payment default registry’s legal basis
as it was not the concern of the complainants.
20. Estonian DPI considers ’s interest valid and therefore the complainants’ interests
or fundamental rights and freedoms are not overridden when their personal data was sent to a
payment default registry. The complainants have failed to pay the debts and therefore their
arrears information was transmitted to the ASNEF which manages the payment defaults.
21. processes complainants’ personal data on the basis of Article 6 (1) (a) and Article
6 (1) (f) when transmitting on personal data to the payment default registry. Estonian DPI agrees
with that legitimate interest exists regarding transmitting complainants’ arrears data to
payment default registry. In addition, the requirements stipulated in Spanish legal act Ley
Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los
derechos digitales Article 20 are met.
Notifying complainants and their requests
22. According to Article 12 (1) of GDPR The controller shall take appropriate measures to
provide any information referred to in Articles 13 and 14 and any communication under Articles
8 (11)
15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible,
and easily accessible form, using clear and plain language. The information shall be provided
in writing, or by other means, including, where appropriate, by electronic means. Article 12
states that where personal data relating to a data subject are collected from the data subject, the
controller shall, at the time when personal data are obtained, provide the data subject with all
of the information named in Article 14. Pursuant to the Article 15 (1) the data subject shall have
the right to obtain from the controller confirmation as to whether personal data concerning him
or her are being processed, and, where that is the case, access to the personal data and the other
information stated in Article 15 (1).
23. Estonian DPI also wants to point out, that contract clause 3.1. and 3.1.1. state that The
Borrower shall notify the Lender without delay, but in any case within five (5) Banking Days
about any changes in the data and/or documents submitted to the Lender, including any
changes in the personal and contact data, occupation, liabilities, assets and/or income of the
Borrower. If the complainants did change their contact info, pursuant to their contracts they had
to notify about such changes.
23.1.
was notified that his debt information may be
sent to ASNEF/EQUIFAX on numerous occasions e.g., 05.06.2019, 09.06.2019,
18.06.2019, 02.07.2019 he was notified by email that he has a debt, and his arrears
information may be sent to ASNEF if after 30 days the obligation will not be fulfilled. On
20.06.2019, a notification was sent with regular mail to his address which was listed as
his contact in the loan agreement. Notification also stated that will forward his
arrears information to ASNEF/EUQUIFAX if he does not pay his debt in 15 days. Even
if the complainant did not receive notifications by email, Equifax has confirmed that the
notification which was sent by regular mail to complainants’ address 20.06.2019 and that
the mail has not been sent back on 21.06.2019.
’s arrears data was added to debt registry
EQUIFAX on 05.07.2019 and 09.08.2019 to Experian debt registry.
04.05.2022 complainant requested debt
documentation from ASNEF and asked the documentation to be sent to email address
[email protected]. received the request on 11.05.2022. Spanish SA
asked why replied to complainant two months later (04.07.2022) if the request
was sent on 04.05.2022. has explained that the delay was caused by human error.
09.12.2022 sent an email to with the
documentation the complainant had requested before.7
23.2.
Complainant was notified about her debt numerous times e.g., 02.09.2019, 01.10.2019,
25.01.2020, 27.03.2020. 09.10.2019 complainant was notified that her arrears
information will be sent to ASNEF if after 30 days the obligation will not be fulfilled.
She was also sent a notification (regarding debt and the possibility about transmission to
ASNEF) to her address in on 24.10.2019 and 05.02.2020.
Notification also stated that will forward his arrears information to
ASNEF/EUQUIFAX if he does not pay his debt in 15 days. Equifax does not have any
data that the complainant did not receive the notifications on 25.10.2019 and 06.02.2020.
Consequently, the complainant was notified about her debt in 2019, 2020, 2021 and
2022.8 Additionally, has sent a log screenshot from their system which shows
that the complainant made payments in 2019.
7
Screenshot of the email in Annex 7 of s reply on 19.04.2023. “ 7 09.12.2022
answer with zip conteiner“
8
Screenshots of emails in Annex 6 of s reply on 03.05.2023. „ 6 _teavitused_list_EE.pdf“
9 (11)
’s arrears information was added
to debt registry 27.03.2020 (Experian) and 21.02.2020 (Equifax).9
Complainant sent her request for documentation with regular mail on 14.07.2022.
received the request on 26.07.2022 and on 08.08.2022 her request was answered.
10
additionally explained how they have notified her about debts and sent loan
agreements, debt notifications (ASNEF), payment schedule and list of payments she has
made. Complainant was asked to identify herself before sending her the requested
documentation on 05.12.2022 and 06.12.2022 since on 11.11.2022, she requested the
documentation to be sent to a third person. explained on 12.06.2023, that the
documents were sent to her 08.09.2022 as mentioned before. has sent the
documentation to Estonian DPI on 12.12.2022.
24. Loan agreement point 13.1 states that the Lender shall have a right to notify the Borrower
thereof and send arrears information to the chosen Payment Default Register and the legal basis
of it– legitimate interest. Both complainants had to be aware of those debts as mentioned above.
Both complainants were notified of the debt and the fact that their arrears information may be
transmitted to Payment Deafult Register ASNEF/EQUIFAX numerous times.
25. After examining the notifications and loan agreements Estonian DPI concludes that
did notify the complainants about how they process their personal data, that they have
a debt and that their arrears information will be sent to payment default registry. has
forwarded notifications and email screenshots which show that the complainants had to be
aware of the debt and that their personal data will be sent to payment default registry. Moreover,
complainants logged into ’s portal after receiving the notifications. Complainants were
informed that their personal data was transmitted to payment default registry.
26. According to Estonian DPI’s payment default instructions for processors and controllers,
the controller or the processor must notify the data subject before sending the personal data or
after the registry receives the data. has sent notifications about the possibility that
complainants’ data will be transmitted to ASNEF but has not specifically notified the
complainants when the data was sent even though the complainants were notified later that their
data was actually transmitted to ASNEF. Estonian DPI recommends that or the
Payment Default Registry should also send a notification when personal data after the data has
been forwarded so that the data subject understands clearly when arrears data is made available
in payment default registry for third parties.
CONCLUSION
As has received personal data from the complainant at the time of concluding the loan
agreement and processes such data lawfully (for the purpose of concluding and
performing the contract) and the complainant has been informed of the transfer of personal data
or the possibility thereof (debt notifications, loan agreement itself, ’s loan infosystem),
we find that the processing of the complainant’s personal data was lawful. Footnote reference
documents will be annexed to this draft.
Based on above, Estonian DPI shall terminate the supervision proceeding.
This decision may be challenged within 30 days by submitting one of the two:
- A challenge to the Director General of the Estonian Data Protection Inspectorate
9
’s reply 28.11.2023 Annex 8.
10
Screenshot of the email in Annex 1 of the ’s reply on 02.05.2023. „ 1 _08.08.2022
vastus koos fa....png“
10 (11)
pursuant to the Administrative Procedure Act11, or
- An appeal to an administrative court under the Code of Administrative Court
Procedure12 (in this case, the challenge in the same matter can no longer be reviewed).
11
https://www.riigiteataja.ee/en/eli/527032019002/consolide
12
https://www.riigiteataja.ee/en/eli/512122019007/consolide
11 (11)