Norwegian Data Protection Authority
Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven
§ 24 første ledd 2. punktum .
IMI reference Our reference Date
A60FD 632894 22/03769 24.04.2024
Rejection of complaint and closure of case – Zalando SE
The Norwegian supervisory authority (Datatilsynet) refers to your complaint dated 13 June
2022 regarding a credit check ordered by Zalando SE (Zalando). In a letter dated 18 August
2022, we informed you that this is a so-called cross-border case, which, according to data
protection rules, is subject to different case handling procedures than ordinary cases.1 The
supervisory authority in Berlin, Germany has handled the case as lead supervisory authority
because Zalando has its main establishment in Berlin. The supervisory authorities in Norway,
Sweden, Denmark, Germany,2 Finland, Poland, Spain, Austria, Luxembourg, France, Italy
and Ireland have participated in the case as concerned supervisory authorities.
About the case handling
The Berlin supervisory authority has investigated the case by contacting Zalando. In
cooperation with us and the other concerned supervisory authorities, they have assessed the
case based on your complaint and other information you have provided, as well as the
responses from the controller. In cooperation, we have made a decision. The case handling
has followed the procedure in Article 60 GDPR, whereby the Berlin supervisory authority has
presented a draft decision. We and the other concerned supervisory authorities agree with the
Berlin supervisory authority’s draft decision, and we are therefore adopting the final decision
in line with their findings.
Our assessment
Datatilsynet closes the case with reference to the reasoning in the decision that follows below.
The decision is written in English. We can assist with translation to Norwegian if needed.
Please contact us if you need the decision translated.
1
See the General Data Protection Regulation (GDPR) Art. 4(23) and Art. 56(1).
2
The regional German supervisory authorities in the states North Rhine-Westphalia, Rhineland-Palatinate,
Thuringia, Lower Saxony, Mecklenburg-Western Pomerania, Hesse, Saarland and Bavaria.
Postal Address: Office address: Phone: Telefax: Ent. reg: Web Address:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 +47 22 42 23 50 974 761 467 datatilsynet.no
0105 OSLO
Decision
The Berlin DPA has concluded the investigation in the present case. A violation of the
GDPR with regard to the processing of the complainant’s personal data could not be
identified.
Reasoning
I.
We have established the following facts:
The complainant, who is resident in Norway, has argued that on 13 May 2022,
Zalando SE (the controller) carried out a credit check on him without his consent in
connection with an order made via the controller’s shop. The complainant had selected
Vipps as a type of payment for the order. Vipps is a Norwegian payment app.
Experian AS informed him about the conduct of the credit check. In a previous order
in 2021, the complainant had used the payment type “purchase on invoice” and, upon
request, the customer service informed the complainant that he had agreed to the credit
assessment when selecting the payment type “purchase on invoice”.
As evidence, the complainant provided a copy of the notification of Experian AS of 13
May 2022 and an order confirmation from the controller dated 17 May 2022. It
follows from the latter that the complainant selected Vipps as the type of payment.
The Berlin DPA also was provided with copied emails from the controller’s customer
service of 18 May 2022, 07:33, 18 May 2022, 10:49, 18 May 2022, 13:06, 18 May
2022, 13:48, 18 May 2022, 15:09 and 19 May 2022, 08:03.
The Berlin DPA heard the controller for their opinion. In their comments of 8
September 2023, the controller informed the Berlin DPA that the complainant had
made an order in 2021 with the payment type “purchase on invoice”. At the time of
the order in May 2022, this type of payment had been pre-selected on the basis of the
previous order from 2021. The complainant confirmed the choice of the payment type
“purchase on invoice” in the new order by clicking on the ‘further’ button. By clicking
on ‘further’, the choice of the type of payment was confirmed and the creditworthiness
assessment was triggered. The complainant then dropped an order step within the
ordering click and changed the payment type to ‘Vipps’ and finally completed the
purchase with Vipps. The legal basis for the creditworthiness check is Article 6(1)(b)
and (f) GDPR. The legitimate interest of controllers is the prevention of defaults, the
detection of fraud and the investigation of criminal offences.
The controller also informed the Berlin DPA that the payment type ‘purchase on
invoice’ could be permanently removed as a possible type of payment if a customer so
wished. With regard to the communication between the complainant and the customer
service, the controller stated that the information provided by the customer service did
2
not meet the current requirements of controllers, as the situation had been described to
the complainant on the basis of the old process in force until June 2021.
Until June 2021, credit rating queries were based on consent. However, in June 2021,
the process in Norway was changed in such a way that creditworthiness queries only
happen after a customer placed goods in the basket, entered his delivery and invoice
address, selected in the checkout process ‘Purchase on invoice’ and confirmed this
input by clicking on the ‘further’ button.
The controller informed the Berlin DPA that the staff of the customer service would
be provided with templates and FAQs to respond to customer requests. However, in
the present case, the employees have answered the complainant’s questions in their
own words. The controller took the opportunity of the present case to instruct
employees once again to take account only of the templates when answering questions
and dealing with customer concerns. In addition, the controller is planning to extend
the drafting templates and FAQs to include further use cases.
II.
From a legal point of view, the Berlin DPA assesses the facts as follows:
The Berlin DPA was not able to establish an infringement by the controller in the
processing of the complainant’s personal data on the basis of the information
provided.
The legal basis for carrying out a credit assessment is Article 6(1)(f) GDPR. The
prevention of defaults constitutes a legitimate interest for the controller within the
meaning of Article 6(1)(f) GDPR. In the present case, however, data processing based
on the legitimate interest is to be regarded as necessary only if there is a credit risk.
However, a credit risk exists only when a customer selects a good, goes through the
purchase process and actually selects a type of payment for which the controller has to
make an advance payment, as is the case for the payment type ‘purchase on invoice’.
In the design of the ordering process, it is therefore necessary to ensure that credit
checks are not carried out simply if a risk-related payment type is not selected at all or
is only accidentally selected.
The ordering process in Norway described by the controller at the time of the alleged
infringement is not to be contested in this respect with regard to the conduct of
creditworthiness queries. The performance of a credit assessment can be based on
Article 6(1)(f) of the GDPR. The legitimate interest of the controller was, inter alia, to
avoid defaults. It was also necessary to carry out a credit test in order to safeguard that
legitimate interest, provided that, as argued by the controller, the creditworthiness
check was carried out only in connection with a specific order and only after the
payment type ‘purchase on invoice’ has been selected, since it can then be assumed
that there is a credit risk for the controller.
3
In so far as the complainant claimed that they had completed the purchase with Vipps,
the controller confirmed this. However, the controller added that the complainant first
selected the payment type ‘purchase on invoice’ by clicking on the ‘further’ button.
The creditworthiness check should therefore be based on Article 6(1)(f) of the GDPR
on the basis of the information available to the Berlin DPA. The fact that the type of
payment ‘purchase on invoice’ had been pre-received on the basis of the
complainant’s previous order cannot be criticised – provided that the selection was
actually made by the respective customer – which is to be assumed in the present case,
as the complainant also stated that he made the order from 2021 with the payment type
‘purchase on invoice’.
In that regard, it should be noted that the carrying out of a credit assessment is not to
be regarded as necessary only after the final placing of an order within the meaning of
Article 6(1)(f) of the GDPR, but, under the above conditions, even during the ordering
process, in order to be able to verify the existence of a risk of non-payment on the
seller’s side.
The Berlin DPA therefore cannot identify an infringement of Article 6(1) and Article
5(1)(a) of the GDPR.
III.
On the basis of this assessment, the Berlin DPA finds that there has indeed been no
violation of data protection rules in the present case. The proceedings are concluded in
accordance with Article 60(8) of the GDPR.
As far as the complaint is concerned, the Berlin DPA considers the matter to be
closed.
Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII GDPR,
and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant to
Section 22(2) of the Norwegian Personal Data Act (personopplysningsloven). This decision
can nevertheless be challenged before Norwegian courts in accordance with Article 78(1)
GDPR.
Kind regards
Tobias Judin
Head of Section
Trine Smedbold
Senior Legal Adviser
4
This document is signed electronically and therefore includes no handwritten signatures.
5