FOR DATA PRIVACY AND FREEDOM OF INFORMATION
FOR INTERNAL USE
Holder of information: Data Protection
Inspectorate
Date: 20.02.2024
Valid until the decision enters into force
Legal ground: Public Information Act § 35 cl 1 p
2
SA Lithuania 20.02.2024 nr 2.1.-1/23/630-1610-7
Final decision
Notice of termination of the proceedings concerning the protection of personal data.
Estonian Data Protection Inspectorate (Estonian DPI) received a complaint through IMI system
(case nr 532854) from SA Lithuania. Since the controller – - has its main
establishment in Tallinn, Estonia, Estonian DPI has accepted the case as LSA.
THE COMPLAINT
Lithuanian citizen lodged a complaint against the controller which is established in Estonia.
Complainant, who is an employee of , says that his personal identification number is seen
together with his name and surname in the invoice which was given to the customer. The
complainant contacted on this issue and explained to the complainant the following
statement: “We see that when you registered to work as a courier for ‘ ’, you did not
submit the individual activity under business certificate, wherein your personal information is
indicated. Since we did not have any other personal information, only this number, which you
have previously forwarded, was written-in to the system. I have corrected this information in
the system and now the clients should see your individual activity under business certificate
code.”
SA Estonia started an investigation in order to clarify the process of collecting data from
couriers by , its purpose and legal basis and sent the controller several inquiries.
POSITION OF THE DATA CONTROLLER
1. Personal data is processed for the performance of the contract concluded with the courier.
So, the processing of courier’s personal data is based on GDPR art 6 cl 1 p b (processing
is necessary for the performance of a contract to which the data subject is party).
collects and processes personal data of couriers to ensure regulatory compliance, for
verifying the courier’s qualifications for pursuing this professional activity of delivering
food and safeguarding the contractual relations associated with the app service,
including resolving any delivery service quality issues and monitoring your compliance
on an ongoing basis.
2. The personal data of couriers is disclosed to clients once the courier has accepted the
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee Registrikood 70004235
request for delivery service and contract for delivery service is concluded between the
client and the courier. The client will see the courier’s name and geographic location of
the courier. At the same time, the personal data of client disclosed to the courier with
whom the client concludes the contract for delivery service. Via app, the courier
will see the first name and first letter of the last name of the client, geographic location
of the client and information of the order for the Meal made by the client (including the
restaurant where the meal was ordered) and contact phone number of the client. Pursuant
to data processing agreement concluded between the courier and , after providing
the delivery service, the courier is entitled to retain the client data related to the
performance of the delivery service for the maximum period of 1 month.
3. Pursuant to § 2(2) of the Accounting Act (AA)1, any legal person in private or public
law registered in Estonia, as well as any self-employed person, is an accounting entity.
Pursuant to § 4(2) of the AA, an accounting entity is obliged to document all economic
transactions. The documentation is based on the basic accounting documents, which
also include invoices. Section 7 of the AA sets out the minimum list of information to
be entered on invoices.
4. If the courier is a taxable person according to § 19 of the Value Added Tax Act (VAT
Act) 2 , couriers must comply with additional requirements, e.g. concerning the
information to be included on invoices according to § 37 of the VAT Act.
5. If the courier is a person liable to VAT under the VAT Code of the Republic of Lithuania
of 5 March 2002, the courier must comply with the provisions of the VAT Code of the
Republic of Lithuania of 5 March 2002. According to this law couriers must comply
with the requirements concerning the information to be provided on invoices pursuant
to Article 80 of the Lithuanian VAT Law.
6. We clarify that pursuant to clause 2.3 of the General Terms and Conditions, acts
only as an information society service provider in the management of
Platform and is not a party to the Sales Agreement or the Delivery Agreement. Pursuant
to clause 2.4 of the General Terms, also acts as an agent of the couriers in the
administration of the Platform in relation to the brokering of delivery
contracts between the couriers and the customers. Each courier, as agent, has authorised
, as agent, to accept certain payments from customers and affiliates on behalf of
and/or for the benefit of the couriers and to distribute the funds received to the couriers
in accordance with the General Terms.
7. Pursuant to clause 8.1 of the General Terms, , acting as agent for the courier, will
prepare and issue invoice(s) to the customer for the courier fee and (where applicable)
the small order fee on behalf of the courier and will accept payment from the customer
for the invoice(s) on behalf of the courier, other than cash payment. The legal basis for
the processing of personal data by the courier is Article 6(1)(b) of the GDPR.
8. Depending on the type of business chosen by the courier (Business Account, Self-
Employed or Company), different information will be displayed on the invoices:
a. Company account: first name and surname of the courier, contact address
(address of ), other information related to the courier service
(total amount, VAT percentage, VAT amount, delivery charge, tip, service
charge).
b. Company and Self-employed: Company or Self-employed business name, Legal
1
https://www.riigiteataja.ee/en/eli/ee/530102013006/consolide/current
2
https://www.riigiteataja.ee/en/eli/ee/527022014003/consolide/current
2 (4)
form, Registration code, contact address, VAT number (if any), Other
information related to the courier service (total amount, VAT percentage, VAT
amount, delivery charge, tip, service charge).
9. In Lithuania, the rules on disclosure are similar:
a. Self-employed person operating under a self-employed person certificate: First
name and surname of the courier, Self-employed certificate number, City from
where the courier service was provided, other information related to the courier
service (total amount, VAT percentage, VAT amount, delivery charge, tip, service
charge).
b. Company: name and surname of the courier, business name of the company,
legal form, registration code, contact address, VAT number, other information
related to the courier service (total amount, percentage of VAT, amount of VAT,
delivery charge, tip, service charge).
10. confirms that as of 17.07.2023 it does not display the personal identification code
of couriers on invoices sent to Lithuanian customers.
POSITION OF THE ESTONIAN DATA PROTECTION INSPECTORATE
11. Person´s ID number together with a person’s full name is considered to be personal data
in the sense of GDPR article 4 p. 1 and not sensitive data in the sense of GDPR article
9. In addition, the status of the courier and its acting legal status (business entity or self-
employed, etc.) is also part of the personal data composition.
12. Estonian DPI has reviewed the reasoning given by the Controller and finds that
according to GDPR article 6 clause 1 p b controller has legal basis for processing
personal data:
a. processing is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data subject prior to
entering into a contract.
13. Estonian DPI agrees after thoroughly reviewing the given answers and provided
documents by that the legal basis for processing courier’s personal
data is provided.
14. The GDPR also lays down the rights of data subjects to the processing of their personal
data. Under Article 16 of the GDPR, the data subject has the right to request the
controller to rectify inaccurate personal data concerning him or her. As the
abovementioned data together fall under the category of personal data, it must be
possible to rectify it and the controller must enable the data subject to rectify the data at
the request of the data subject. The data subject has requested to rectify the status
of the courier’s legal basis for providing courier services.
15. , as the controller of the personal data, must provide the data subject without undue
delay, but no later than one month after receipt of the request, with information on the
action taken in response to a request pursuant to Articles 15 to 22 of the GDPR. That
period may, where appropriate, be extended by two months considering the complexity
and amount of the application. The controller shall inform the data subject of any such
extension and of the reasons for the delay within one month of receipt of the request
(Article 12(3) GDPR).
16. If the controller fails to act on the request of the data subject, it shall inform the data
subject without delay and at the latest within one month of receipt of the request of the
reasons for not acting and explain the possibility of lodging a complaint with the
3 (4)
supervisory authority and seeking a judicial remedy (Article 12(4) of the GDPR).
17. In analysing controller’s actions regarding article 12, the Estonian DPI makes notice of
the complainant’s own actions, where he, when first registering as a courier, provided
with information that was inaccurate (choosing to be a business entity rather than
self-employed). After the complainant realised that his personal ID was displayed on
the invoices, he contacted the data controller with a right to rectification and right
to information to which immediately remedied the situation. With this the data
controller has met all the requirements in GDPR article 5 clause 1 point d, article 12 and
article 16 clause 1.
To conclude, SA Estonia will terminate the proceedings regarding the complaint made
against because the data subject request has been fulfilled and no
persistent GDPR infringements have been identified.
This decision may be challenged within 30 days by submitting one of the two:
- A challenge to the Director General of the Estonian Data Protection Inspectorate pursuant to
the Administrative Procedure Act3, or
- An appeal to an administrative court under the Code of Administrative Court Procedure 4 (in
this case, the challenge in the same matter can no longer be reviewed).
Best regards
Data security expert
authorized by Director General
3
https://www.riigiteataja.ee/en/eli/527032019002/consolide
4
https://www.riigiteataja.ee/en/eli/512122019007/consolide
4 (4)