2/5
unsubscribed the complainant received further emails from on 4
April 2022, 22 April 2022 and 3 May 2022. On 4 April 2022 the complainant sent an email
to the controller requesting the information pursuant to Art. 15 GDPR. He did not receive a
reply.
As a cross-border case, the complaint was dealt with in accordance with Article 60 GDPR.
For the controller having its place of domicile in Liechtenstein the DPA Liechtenstein was
the lead supervisory authority in accordance with Article 56 (1) GDPR.
By letter of 31 August 2022 the controller was requested to reply to the allegations brought
forward by the complainant. In particular the controller was asked to provide information
on the following:
a. information on his role in sending the newsletters
b. information on the legal basis for processing the personal data of the complainant
c. his role in replying to the information request of 4 April 2022
d. his role in the deregistration from the newsletters.
The controller informed the DPA Liechtenstein to the points a. to d. above in summary as
follows:
a. The controller informed the DPA Liechtenstein that it was a licensee for the
trademark and in this function was responsible for the organization and
realization of events under this trademark in Germany. The controller further informed the
DPA Liechtenstein that as a licensee it was responsible for the promotion of events under
this trademark in Germany. The controller confirmed that it had sent the newsletters of 22
April 2022 and 3 May 2022 to the complainant and informed to newsletters in general that
these were directed to persons who had bought tickets for events in 2020 which failed to
realize because of the COVID-19 pandemic and as a result thereof had received vouchers
for later events.
b. The controller informed the DPA Liechtenstein that the legal basis for processing the
personal data of the complainant was a licence contract with The
controller informed the DPA Liechtenstein that it exclusively processed the data upon strict
instruction of the licensor.
c. The controller confirmed that it was responsible for information requests pursuant
to Art. 15 GDPR in general but in the present case it did not receive the demand thereto by
the complainant. The controller argued that the complainant had used the wrong email-
address when making his information request.
d. As to the deregistration from newsletters the controller informed that
deregistrations are executed in an automated way in the customer relation management
system (CRM) when a person wishing to do so makes such a demand. The controller further
3/5
informed that the technical set-up was made by the licensor and is under the control of the
latter.
As to the demand for deregistration from newsletters made by the complainant on 7 March
2021 the controller informed that it was not able to check whether such a deregistration
demand was received at that date. The controller informed that failure to be able to check
this was due to a change of systems used for the management of subscribers to newsletters.
The controller argued that it would need to have access to the old system which it did not
have. Checking the new system now used the controller confirms to find an entry of
deregistration there on 23 April 2022.
2. Complaint:
On the basis of the submissions of the complainant, the legal question was whether the
controller had a legal basis for processing the data of the complainant under Art. 6 para. 1
GDPR. Further, there was the legal question whether the rights of the complainant based
on Art. 15 and 17 GDPR were infringed and whether such infringements were attributable
to the controller.
3. Legal framework:
a) Competence of the lead supervisory authority
is a company domiciled in Liechtenstein, registered in the
Liechtenstein Trade Register under number for which the GDPR is
applicable. According to Art. 55 GDPR, the DPA Liechtenstein was the competent national
data protection supervisory authority.
According to Art. 2 para. 1 GDPR, the GDPR applies to the full or partial automated
processing of personal data. According to the definition in Art. 4 point 1 GDPR "personal
data" are all information relating to an identified or identifiable natural person, such as
name, location data, online identification and other personal data as stated in Art. 4 point
1 GDPR. For the present complaint the email address of the complainant was processed
when sending him the newsletters. These data are personal data of natural persons in
accordance with the legal definition of Art. 4 (1) GDPR. According to Art. 2 para. 1 GDPR,
the present complaint falls within the material scope of the GDPR.
b) Infringement of Art. 6 GDPR
With a view to determine the role of the DPA Liechtenstein based
its analysis on 1. statements made by the aforesaid company in general, 2. by analyzing the
relationship between the licensor and the licensee based on the statements made by the
licensee (= the controller), 3. by analyzing the documents submitted by the complainant
and 4. by analyzing the privacy declaration and the imprint on the website.
4/5
Concerning the licence relationship between the licensor and the licensee the DPA
Liechtenstein ascertained that the licensee (= the controller) when promoting and
implementing events under the brand, had a certain amount of leeway
due to the nature of such activities. Within the scope of the license agreement, the licensee
(= the controller) represented the brand and in this context had certain
discretionary power in deciding where, how and when data was processed. It was hence to
be qualified as a controller.
The privacy declaration on the website stated that controller for the processing of personal
data is the party stated in the various channels of communication (website, e-mail etc.). In
the course of promoting and implementing events under the brand, the
controller sent the promotional emails subject of the complaint to the complainant. With
these emails, the controller announced events under the brand.
With regard to the newsletter recipients, amongst them the complainant, the controller,
pursuant to statements made by it, accessed the platforms provided by the trademark and
rights owner.
The controller argued that the newsletters of 22 April 2022 and 3 May 2022 were
newsletters that were marked as "transactional" because they were addressed to voucher
holders and were therefore not to be considered as advertising emails. By using this
argumentation the controller tried to have resort to the legal basis of Art. 6 para. 1 letter f
GDPR, eventually also Art. 6 para. 1 letter b GDPR.
The DPA Liechtenstein, by analyzing the subject emails, found that these emails in no way
could be classified as transactional emails. To be classified as transactional emails such
emails should only have been addressed to voucher holders. In reality, however, those
emails were addressed to all persons listed in the data base. At the end of the emails it was
stated: “You receive this newsletter (then followed by stating the email address of the
complainant) because you have registered yourself with .” Based on this it had
to be assumed that the emails were directed to any person who was registered in the data
base as recipient of newsletters. Also, the content of the subject emails themselves
supported no other result.
By using the argumentation that the subject emails were “transactional emails” the
controller tried to find a legal basis directing away from the lack of consent. In fact, the basis
of the consent as legal basis for the processing fell away upon deregistration by the
complainant from the newsletter subscription. The complainant proved the deregistration
on 7 March 2021 by submitting the relevant documentation thereto. The complainant from
this date onwards, hence, should not have received further newsletters. The controller for
his part confirmed to have found a date of deregistration on 23 April 2022. The complainant
at least should not have received the email of 3 May 2022 then.
The infringement due to the transmission of the subject newsletters to the complainant
without a legal basis pursuant to Art. 6 para. 1 letter a GDPR was attributable to the
controller: In its function as licensee, the controller was responsible for the organization
and implementation of the events under the brand in Germany and as part
5/5
of the promotion of the events sent the emails in question to the complainant. The
controller expressly confirmed having sent the emails to the complainant in its statement
and confirmed its leeway therewith.
c) Infringement of the right of access according to Art. 15 GDPR
The controller confirmed in its statement that it was responsible for access requests
according to Art. 15 GDPR. However, the controller claimed that it did not receive the
respective access request stating that the complainant addressed the demand to an email
address which did not reach it. The controller provided information on how it should have
been contacted. The DPA Liechtenstein found that it cannot be the duty of the complainant
to search through the website to find the appropriate way how the controller was meant to
be contacted. The Liechtenstein DPA found that it was indeed correct that the complainant
addressed his demand according to Art. 15 GDPR to the email address where the emails
were sent from by the controller. Said email address was not marked as a no reply-email-
address. Indirectly the controller admitted the fault. In fact, it stated that emails directed to
the said email address were now redirected to it and would reach it henceforth.
In its statement, the controller left unanswered the question who was responsible for the
lack of forwarding of such e-mails sent to to it. It offered no
evidence for that. However, the controller conceded that it was responsible for requests
made by data subjects pursuant to Art. 15 GDPR. According to Art. 15 para. 1 GDPR, it is the
responsibility of the controller to comply with requests for information in accordance with
Art. 4 para. 7 GDPR. Failure on the part of the controller to comply with the obligation
resulting from Art. 15 GDPR led to a violation of Art. 15 GDPR by the same.
d) Infringement of the right of erasure according to Art. 17 GDPR
The request by the complainant to delete his personal data in accordance with Art. 17 para.
1 letter b GDPR was made by the complainant using the option provided for on the website
to unsubscribe from newsletters on 7 March 2021. The complainant gave clear evidence for
this. Therefrom onwards the complainant should no longer have received newsletters from
the controller. In fact, however, the controller subsequently received the promotional
emails of 4 April 2022, 22 April 2022 and 3 May 2022. This means that the complainant’s
personal data was still registered as recipient for newsletters on 3 May 2022.
In its statement to the DPA Liechtenstein the controller argued that the trademark and
rights holder (licensor), was responsible for registering the deregistration
from the newsletter mailing. Unsubscribing from the newsletter was automated in the CRM
system and the settings for this was set up by the licensor. The controller did not provide
any evidence that it was not responsible for the deletion, but rather the licensor. In
accordance with this, the failure to delete the data pursuant to Art. 17 para. 1 letter b GDPR
was attributable to the controller and it was established that the controller committed an
infringement of Art. 17 GDPR.