Norwegian Data Protection Authority
Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven
§ 24 første ledd 2. punktum .
IMI reference Our reference Date
A60FD 632324 21/01484 24.04.2024
Rejection of complaint and closure of case – Zalando SE
The Norwegian supervisory authority (Datatilsynet) refers to your complaint dated 12 April
2021 regarding credit checks ordered by Zalando SE (Zalando). In an email dated 1 October
2021, we informed you that this is a so-called cross-border case, which, according to data
protection rules, is subject to different case handling procedures than ordinary cases.1 The
supervisory authority in Berlin, Germany has handled the case as lead supervisory authority
because Zalando has its main establishment in Berlin. The supervisory authorities in Norway,
Sweden, Denmark, Germany,2 Finland, Poland, Spain, Austria, Luxembourg, France, Italy
and Ireland have participated in the case as concerned supervisory authorities.
About the case handling
The Berlin supervisory authority has investigated the case by contacting Zalando. They have
also asked for your feedback to the company’s responses. In cooperation with us and the other
concerned supervisory authorities, they have assessed the case based on your complaint and
other information you have provided, as well as the responses from the controller. In
cooperation, we have made a decision. The case handling has followed the procedure in
Article 60 GDPR, whereby the Berlin supervisory authority has presented a draft decision.
We and the other concerned supervisory authorities agree with the Berlin supervisory
authority’s draft decision, and we are therefore adopting the final decision in line with their
findings.
Our assessment
Datatilsynet closes the case with reference to the reasoning in the decision that follows below.
The decision is written in English. We can assist with translation to Norwegian if needed.
Please contact us if you need the decision translated.
1
See the General Data Protection Regulation (GDPR) Art. 4(23) and Art. 56(1).
2
The regional German supervisory authorities in the states North Rhine-Westphalia, Rhineland-Palatinate,
Thuringia, Lower Saxony, Mecklenburg-Western Pomerania, Hesse, Saarland and Bavaria.
Postal Address: Office address: Phone: Telefax: Ent. reg: Web Address:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 +47 22 42 23 50 974 761 467 datatilsynet.no
0105 OSLO
Decision
I.
The above-mentioned complainant, based in Norway, submitted that the controller
Zalando SE (controller) had checked its creditworthiness with Experian AS at regular
intervals without cause, in particular not in connection with an order. The complainant
was informed by Experian AS about the credit checks by the controller and in this
respect submitted copies of notifications from Experian AS dated 9 April 2018, 23
October 2018, 23 June 2018, 25 September 2019, 20 March 2020, 30 September 2020,
30 March 2021 and 26 April 2022.
Although the complainant was a customer of the controller, she had only placed orders
with the controller on 30December 2014 and 25 September 2019. On 2 October 2020,
the complainant called customer service to request the erasure of her customer
account. On the same day, customer service asked the complainant by e-mail to
provide three out of six details for comparison or to send an e-mail from the e-mail
address stored in the customer account in order to be able to carry out the erasure. The
complainant did the latter on 5 October 2020. Customer service then informed the
complainant by email that her customer account had been deactivated and would be
deleted in five days. Nevertheless, the complainant received a notification of a credit
check by the controller from Experian AS on 30 March 2021 and most recently on 26
April 2022. The complainant was also able to continue logging into her customer
account.
In a statement dated 9 August 2022, the controller informed the Berlin DPA that an
internal investigation had revealed that two customer accounts with the controller had
been created with the complainant's social security number. In addition, there were
further matches in the two customer accounts, including name, date of birth, gender,
and in some cases also the delivery and billing address.
The controller has stated that no routine credit checks are carried out, but only in
connection with a specific order when selecting the risky payment method "purchase
on account". The legal basis for the credit check is Art. 6 (1) (b) or (f) GDPR.
An order was placed on 25 September 2019 via the customer account with the number
A [redacted], in which the above-mentioned e-mail address of the complainant (A
[redacted]@gmail.com) was stored. The payment method "purchase on account" was
selected.
Orders were placed on 20 March 2020, 30 September 2020, 30 March 2021 and 26
April 2022 via the second customer account with the number B [redacted], in which
the e-mail address B [redacted]@gmail.com was stored, for which the payment
method "purchase on account" was also selected.
2
On a further three days (9 April 2018, 23 June 23 2018 and 23 October 2018), a login
to the customer account with the number B [redacted] took place, but no order was
placed. The controller assumes that the order process was cancelled in the last step of
the check-out process. A total of 33 orders were placed from this customer account
between 2017 and 2022, thirty of which were placed using the "purchase on account"
payment method.
With regard to the request for erasure, the controller stated that the customer account
with the number A [redacted] had not been erased. The controller was no longer able
to fully clarify why the account had not been erased. In this respect, the controller
submitted that the screenshots provided by the complainant did not reveal the sender
and recipient of the emails. The communication with the complainant was no longer
available for the controller. The facts of the case could therefore no longer be fully
clarified. It is possible that the erasure was not carried out due to the duplicate account
management. The customer account with the number A [redacted] was finally
deactivated on 2 August 2022.
The Berlin DPA informed the DPA in Norway of the content of the statement on 14
September 2022 and asked them to inform the complainant of the current status. In
particular, the Berlin DPA asked the DPA in Norway to ask the complainant whether
the controller's statements are correct and whether the complainant is the holder of
both customer accounts. The Berlin DPA also asked for the complete email
communication between the complainant and the controller.
In a letter dated 2 January 2023, the DPA in Norway informed the Berlin DPA that the
complainant had replied that the customer account with the number A [redacted]
belonged to her daughter [redacted]. The complainant had created the account for her
daughter when she was still a minor. The daughter is now 22 years old. The
complainant had confirmed that the above-mentioned orders had been placed by her
daughter. She suspected that some of her personal data was still linked to the customer
account.
The Norwegian DPA stated that it was assumed that the complaint regarding the
performance of the credit checks had now been resolved for the complainant.
Finally, the complainant stated that the customer account with the number B
[redacted], which her daughter uses, should be reactivated. With regard to the
customer account with the number A [redacted] used by her, she continued to request
erasure.
II.
The Berlin DPA’s legal assessment of the facts of the case is as follows:
3
With regard to the performance of the credit checks, the Berlin DPA assumes that the
facts of the case have been clarified to the satisfaction of the complainant and that the
subject matter of the complaint has been resolved.
Irrespective of this, the Berlin DPA was unable to establish an infringement by the
controller in the processing of the complainant's personal data on the basis of the
information provided to the Berlin DPA, as the credit checks mentioned above were
probably carried out lawfully on the basis of Art. 6 (1) (f) GDPR. At least insofar as
the credit check, as submitted by the controller, was only carried out in connection
with a specific order and only after selecting the payment method "purchase on
account", as in this case it can be assumed that the controller has an overriding
legitimate interest.
The complainant confirmed the above-mentioned orders by herself or her daughter and
admitted that she had created both customer accounts herself. In this respect, the
Berlin DPA assumes that the complainant has also deposited her Social Security
Number in both customer accounts. Therefore, there is no reason to doubt the
controller's statements available in this case. The Berlin DPA is therefore unable to
establish an infringement of Art. 6 (1), Art. 5 (1) (a) GDPR.
With regard to the request for erasure, the Berlin DPA cannot prove an infringement
of Art. 17 (1) GDPR by the controller, as the corresponding communication between
the complainant and the controller was not submitted to the Berlin DPA in full or
could no longer be submitted to the Berlin DPA. In addition, due to the duplication of
customer accounts using the same Social Security Number, it seems at least possible
that the controller could invoke an exemption from the erasure obligation pursuant to
Art. 17 (3) (b) or (e) GDPR. In any case, after submitting the complaint to the DPA in
Norway, the controller should be able to invoke the exception pursuant to Art. 17 (3)
(e) GDPR.
Insofar as the controller has informed the Berlin DPA that the complainant has
informed them that the customer account used by her daughter with the number B
[redacted] is to be reactivated, while the customer account used by the complainant
with the number A [redacted] is to be deleted, the Berlin DPA requests the
complainant to contact the controller again with reference to the conclusion of the
present investigation.
With regard to the granting of access to the customer account, the Berlin DPA would
like to point out that the reactivation of the customer account or a possible claim to
access to the account is regulated in the terms of use, which are regularly agreed to
when the customer account is set up. This is an agreement under civil law between the
respective customer and the controller. The enforcement of rights and claims arising
from this must be asserted by civil law if necessary.
4
III.
Based on this assessment, the Berlin DPA assumes that no infringement of data
protection regulations has actually occurred in the present case. The case is closed
pursuant to Art. 60 (8) GDPR.
As far as the complaint is concerned, the Berlin DPA consider the matter to be closed.
Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII GDPR,
and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant to
Section 22(2) of the Norwegian Personal Data Act (personopplysningsloven). This decision
can nevertheless be challenged before Norwegian courts in accordance with Article 78(1)
GDPR.
Kind regards
Tobias Judin
Head of Section
Trine Smedbold
Senior Legal Adviser
This document is signed electronically and therefore includes no handwritten signatures.
5