PROTECTION OF PRIVATE LIFE AND TRANSPARENCY OF THE STATE
ANDMEKAITSE INSPEKTSIOON
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Indication made: 22.03.2024
The access restriction applies until: 22.03.2099
for p. 2 until entry into force of the Decision
Legal ground: Public Information Act § 35 (1) p. 2, p. 12
Unofficial translation
Ours: 22.03.2024 nr 2.1.-1/23/1105-2744-7
# ARTICLE 60 FINAL ADOPYED DECISION
# Notice of termination of proceedings concerning the protection of personal data
The Lithuanian Data Protection Authority forwarded to the Estonian Data Protection Inspectorate (Estonian DPI) a request from [REDACTED] according to which [REDACTED] regularly sends to him travel receipts from a third party ([REDACTED]). According to the complaint, the person turned to the data controller with a request to stop transferring the data of another person to him, but without result.
On the basis of Section 56 (3) 8) of the Personal Data Protection Act, the Estonian DPI initiated a supervisory procedure and submitted an enquiry No 2.1.-1/23/1105-2744-2 to [REDACTED] on 08.01.2024.
On 23.01.2024 [REDACTED] explained the circumstances of the case in his reply to the Estonian DPI and noted that as of 15.12.2023, the complainant no longer received notices containing the personal data of [REDACTED]. The data controller confirmed that the customer support did not follow the rules established when receiving a person’s request (the privacy team was not informed, therefore it was not possible to assess the risk and take appropriate measures). At the same time, the data controller confirmed that he had given additional instructions to his customer support team to prevent such a case from happening again.
The Lithuanian Data Protection Authority forwarded to the Estonian DPI the complainant’s confirmation that the complainant had received an email from [REDACTED] concerning another person most recently on 12 December 2023.
As the infringement has ended, Estonian DPI will terminate the proceedings in this matter.
This decision may be challenged within 30 days by submitting one of the two:
- A challenge to the Director General of the Estonian Data Protection Inspectorate pursuant to the Administrative Procedure Act¹, or
- An appeal to an administrative court under the Code of Administrative Court Procedure² (in this case, the challenge in the same matter can no longer be reviewed).
¹ https://www.riigiteataja.ee/en/eli/527032019002/consolide
² https://www.riigiteataja.ee/en/eli/512122019007/consolide
Tatari 39, 10134 Tallinn
Registry code 70004235
Telephone 627 4135
E-mail [email protected]
www.aki.ee
With respect
Lawyer
Authorized by Director General
2 (2)