Norwegian Data Protection Authority
Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven
§ 24 første ledd 2. punktum .
IMI reference Our reference Date
A60FD 632873 21/04063 24.04.2024
Rejection of complaint and closure of case – Zalando SE
The Norwegian supervisory authority (Datatilsynet) refers to your complaint dated 6
December 2021 regarding a credit check ordered by Zalando SE (Zalando). In a letter dated
10 May 2022, we informed you that this is a so-called cross-border case, which, according to
data protection rules, is subject to different case handling procedures than ordinary cases.1
The supervisory authority in Berlin, Germany has handled the case as lead supervisory
authority because Zalando has its main establishment in Berlin. The supervisory authorities in
Norway, Sweden, Denmark, Germany,2 Finland, Poland, Spain, Austria, Luxembourg,
France, Italy and Ireland have participated in the case as concerned supervisory authorities.
About the case handling
The Berlin supervisory authority has investigated the case by contacting Zalando. They have
also asked for your feedback to the company’s response. In cooperation with us and the other
concerned supervisory authorities, they have assessed the case based on your complaint and
other information you have provided, as well as the responses from the controller. In
cooperation, we have made a decision. The case handling has followed the procedure in
Article 60 GDPR, whereby the Berlin supervisory authority has presented a draft decision.
We and the other concerned supervisory authorities agree with the Berlin supervisory
authority’s draft decision, and we are therefore adopting the final decision in line with their
findings.
Our assessment
Datatilsynet closes the case with reference to the reasoning in the decision that follows below.
The decision is written in English. We can assist with translation to Norwegian if needed.
Please contact us if you need the decision translated.
1
See the General Data Protection Regulation (GDPR) Art. 4(23) and Art. 56(1).
2
The regional German supervisory authorities in the states North Rhine-Westphalia, Rhineland-Palatinate,
Thuringia, Lower Saxony, Mecklenburg-Western Pomerania, Hesse, Saarland and Bavaria.
Postal Address: Office address: Phone: Telefax: Ent. reg: Web Address:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 +47 22 42 23 50 974 761 467 datatilsynet.no
0105 OSLO
Decision
The investigation initiated in response to the above complaint has been completed.
Based on the information provided, the Berlin DPA has not been able to establish an
infringement of the General Data Protection Regulation (GDPR) in the processing of
the complainant’s personal data by the controller Zalando SE.
Reasoning:
I.
The Berlin DPA has established the following facts:
The complainant stated that they had created a customer account with the controller on
24 November 2021. The complainant did not place an order. However, they were
informed by a letter from Experian AS dated 24 November 2021 that the controller
had carried out a credit check of them. The complainant sent the Berlin DPA a copy of
the notification. In addition, the complainant informed the Berlin DPA that their
customer account shows that they are not offered the payment method ‘purchase on
invoice’.
On the occasion of the notification about the credit check, the complainant contacted
customer service by email on 27 November 2021, expressly pointing out that they had
not made a purchase. Customer service informed the complainant that the controller
was carrying out credit checks to check whether the ‘purchase on invoice’ payment
method could be offered. The customer service could inform them that if the
complainant no longer wished to have credit checks carried out, the ‘purchase on
invoice’ payment method would no longer be available (customer service emails dated
27 and 28 November 2021). Customer service also explained that the complainant had
agreed to credit checks being carried out when the complainant had registered with the
controller by accepting the terms and conditions and the privacy policy (customer
service email dated 28 November 2022).
The Berlin DPA asked the controller for a statement on the matter. In a statement
dated 7 July 2022, the controller informed the Berlin DPA that credit checks are not
carried out independently of orders. Credit checks are only carried out in connection
with a specific order if a risky payment method (‘purchase on invoice’) is selected.
Since June 2021, credit checks in Norway have only been carried out after a customer
has placed goods in the shopping cart, entered their delivery and billing address,
selected ‘purchase on invoice’ in the check-out process and confirmed this by clicking
on the ‘Continue’ button. Clicking the ‘Continue’ button is the last step in the
checkout process before the final page with the order summary appears. Then, the
final completion of the order follows by clicking on the ‘Confirm’ button.
2
In the course of the order or checkout process, the customer is initially offered all
possible payment methods. If the customer selects ‘purchase on invoice’, they are
asked to enter their Social Security Number. The Social Security Number is then used
to check the credit rating with Experian AS, based in Oslo. Customers are also
informed of this. The controller provided the Berlin DPA with a screenshot of the
Norwegian order page.
In the present case, the controller assumes that the complainant wanted to place an
order after registering and selected the corresponding goods and the payment method
‘purchase on invoice’. Furthermore, the controller assumes that the order was not
completed because the order process was cancelled. The legal basis for the credit
check is Art. 6(1)(b) or (f) GDPR (not consent pursuant to Art. 6(1)(a) GDPR). With
regard to the communication between the complainant and customer service, the
controller stated that some of the responses from the relevant employees did not
correspond to the internal templates and training. The case in question was taken as an
opportunity to clarify how the misinformation could have occurred.
We have informed the Norwegian DPA of the state of affairs and asked them to
inform the complainant accordingly. The Berlin DPA has also asked the complainant
to inform the Berlin DPA if the facts presented by the controller are incorrect.
The Norwegian DPA forwarded to the Berlin DPA the complainant’s email dated 17
October 2022. In it, the complainant states that the information provided by the
controller was incorrect. However, the complainant then describes that they placed an
order with the controller immediately after creating the account on November 24,
2021 and wanted to pay for it ‘on invoice’. This was blocked by the controller and the
complainant was only able to pay by credit card.
In the complaint, the complainant alleges that there was no legal basis for the credit
check at Experian AS by the controller.
II.
Our legal assessment of the facts of the case is as follows:
With regard to the performance of the credit check, based on the information provided,
the Berlin DPA was unable to establish an infringement by the controller in the
processing of the complainant’s personal data.
The legal basis for carrying out a credit check is Art. 6(1)(f) GDPR. The avoidance of
payment defaults constitutes a legitimate interest of the controller within the meaning
of Art. 6(1)(f) GDPR. However, data processing for the purposes of the legitimate
interest can only be considered necessary if there is a credit risk. However, a credit
risk only exists if and when a customer selects a product, goes through the purchase
process and actually selects a payment method that requires the controller to make
advance payments, as is the case with the ‘purchase on invoice’ payment method.
3
When designing the order process, it must be ensured that credit checks are not carried
out if a risky payment method is not clicked on at all or only inadvertently.
Against this background, the ordering process in Norway described by the controller
at the time of the alleged infringement is not objectionable with regard to the
performance of credit checks. The performance of a credit check can be based on Art.
6(1)(f) GDPR. The controller’s legitimate interest was the avoidance of payment
defaults. Carrying out a credit check was also necessary to safeguard this legitimate
interest if the credit check was only carried out in connection with a specific order and
only after selecting the payment method ‘purchase on invoice’, as the existence of a
credit risk for controllers can then be assumed. In addition, the requirement to enter
the Social Security Number and the requirement to click on the ‘Continue’ button
ensures that a credit check is not carried out if a person inadvertently clicks on
‘purchase on invoice’.
In the present case, the complainant confirmed that they initially wanted to order the
goods ‘on invoice’ and only cancelled the order process when this was not possible.
The Berlin DPA was therefore unable to establish that the actual ordering process did
not correspond to the ordering process presented by the controller. On the contrary,
this was confirmed.
Insofar as the complainant stated that they have not ordered anything, this does not per
se remove the legal basis for carrying out a credit check. It should be noted that
carrying out a credit check is not only necessary after the final placement of an order
within the meaning of Art. 6(1)(f) GDPR, but under the above-mentioned conditions
already during the ordering process in order to be able to check the existence of a risk
of non-payment on the seller’s side before the order is completed.
We therefore cannot establish an infringement of Art. 6(1) or Art. 5(1)(a) GDPR.
III.
Based on this assessment, the Berlin DPA assumes that no infringement of data
protection regulation has actually occurred in the present case. The case is closed
pursuant to Art. 60(8) GDPR.
As far as the complaint is concerned, the Berlin DPA considers the matter to be
closed.
Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII GDPR,
and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant to
Section 22(2) of the Norwegian Personal Data Act (personopplysningsloven). This decision
can nevertheless be challenged before Norwegian courts in accordance with Article 78(1)
GDPR.
4
Kind regards
Tobias Judin
Head of Section
Trine Smedbold
Senior Legal Adviser
This document is signed electronically and therefore includes no handwritten signatures.
5