¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
Our reference: LDA-1085.1-2300/20-F
IMI Art. 61: 185779
IMI draft decision: 591896
Controller: (publ)
On the basis of the draft decision of the Swedish Integritetsskyddsmyndigheten (SWE DPA) No. 591896,
the Data Protection Authority of Bavaria for the Private Sector (BayLDA) pursuant to Article 60(8) of the
GDPR issues the following
Final Decision:
The complaint is rejected.
Justification:
The complaint was received by the BayLDA on 02.03.2020 and was forwarded via IMI to the SWE DPA as
the lead data protection supervisory authority for the controller.
On 02.01.2024, the SWE DPA submitted the draft decision no. 591896 to the concerned supervisory au-
thorities with the following contents:
Decision of the Swedish Authority for Privacy Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that the investigation has not shown that
has processed the complainant’s personal data in breach of Article 6(1) of the General
Data Protection Regulation in the manner alleged in the complaint.
The case is closed.
Report on the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated an audit towards (the
company or ) due to a complaint. The complaint has been submitted to IMY, as a supervisory
authority for the company’s operations pursuant to Article 56 of the General Data Protection Regula-
tion from the supervisory authority in Germany where the complainant has lodged their complaint in
accordance with the GDPR’s provisions on cooperation in cross-border processing.
The investigation in the case has been carried out through written correspondence. On 10 of Novem-
ber 2023, IMY sent a request for information to , in order to ascertain whether was the
controller of the processing in question and, if so, under which legal basis under Article 6(1) of the
GDPR the applicant's personal data had been processed.
Since this is a complaint relating to cross-border processing, IMY has used the mechanisms for coop-
eration and consistency contained in Chapter VII GDPR. The supervisory authorities concerned has
been the data protection authorities in Germany, The Netherlands, Norway, France, Finland and Den-
mark.
The complaint
In its complaint, the complainant essentially stated the following. The complainant made two attempts
to purchase an online service on 26 August 2019. The complainant used as a payment solution.
The complainant made a third attempt to purchase the online service on 2 September 2019. The com-
plainant used as a payment solution on this occasion as well. This purchase went through.
subsequently invoiced the appellant for two purchases, even though only one purchase was
successful. then forwarded the complainant's personal data to a debt collection agency. Accord-
ing to the complainant, did not have the right to process her personal data in the way that it
did.
What has stated
has mainly stated the following. In its statement dated 24 November 2023, has stated
that it cannot identify the complainant with the information available from the complaint and that it is
therefore unable to answer the questions in IMY: s supervision letter, unless they receive more infor-
mation.
On 28 November 2023, IMY contacted by telephone to find out what additional information
needed to be able to identify the complainant. replied that they needed information
about the email address with which the purchase had been made.
On 29 November 2023, IMY communicated 's response to the concerned national supervisory
authority in the country where the complainant filed the complaint (Germany) and asked them to con-
tact the complainant in order to obtain the requested email address.
On 21 December 2023, the national supervisory authority (Germany) returned with the information
that the complainant had not returned.
Justification of the decision
It follows from Article 57(1)(f) of the GDPR that Swedish Authority for Privacy Protection (IMY) must
deal with complaints from data subjects who believe that their personal data is being processed in a
way that is contrary to the GDPR. The provision also states that IMY shall, where appropriate, investi-
gate the subject matter of the complaint. The Court of Justice of the European Union has stated that
the supervisory authority shall investigate such complaints with due diligence. (Schrems II, case C-
311/18, EU:C:2020:559, para. 109.)
According to Section 23 of the Swedish Administrative Procedure Act (2017:900), an authority shall en-
sure that a case is investigated to the extent required by its nature.
IMY: s audit concerns whether , as data controller, has processed the complainant's personal
data without a legal basis in Article 6(1) of the General Data Protection Regulation. has not been
able to answer IMY: s questions concerning the processing of the complainant's personal data in the
light of the fact that they have not been able to identify the complainant. The complainant has been
given the opportunity to supplement complaint with information about the e-mail address used
for the purchase in question.
IMY considers that the matter has been investigated to the extent required by Article 57(1)(f) of the
General Data Protection Regulation and Section 23 of the Swedish Administrative Procedure Act. IMY
notes that there is no basis in the investigation to conclude that processed the complainant's
personal data without a legal basis in Article 6(1)(f) of the GDPR.
The case is closed.
As the concerned supervisory authorities (including BayLDA) did not object to this draft decision, the
BayLDA hereby adopts this draft decision as final decision in accordance with Article 60(8) of the GDPR.
Ansbach, 20.02.2024