1(7)
Etraveli Group AB
Reference number:
IMY-2024-4541 Final decision under the General Data
Date of decision: Protection Regulation – Etraveli
2024-06-07
Group AB
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Authority for Privacy Protection (IMY) finds that the investigation in the case does
not show that Etraveli Group AB (Etraveli Group), 556584-4684, has processed
personal data in breach of Article 15 of the General Data Protection Regulation1
(GDPR) as alleged in the complaint.
IMY finds that Etraveli Group has processed personal data in breach of
• Article 12.2 of the GDPR by not facilitating the complainants exercise of the
right of access and
• Article 12.3 of the GDPR by not without undue delay informing the
complainant of the outcome of his request for access.
IMY decide to issue a reprimand to Etraveli Group pursuant to Article 58.2 b of the
GDPR for the breach of Article 12.2 and 3 of the GDPR.
Presentation of the supervisory case
IMY has initiated supervision regarding Etraveli Group due to complaint in order to
investigate whether the complainant’s request of access has been handled in
accordance with Articles 12 and 15 of the GDPR. The decision only concerns the
handling of the complainant’s request and does not concern Etraveli Group’s general
handling regarding data subjects right of access.
Background
Postal address:
Box 8114
IMY has previously carried out a supervisiory case against Etraveli Group’s wholly-
104 20 Stockholm owned subsidiary Gotogate International AB (Gotogate) due to the current complaint in
Website:
order to investigate whether the complainant had been provided access in accordance
www.imy.se with Article 15 of the GDPR (IMY-2023-8282). On 1 November 2023, IMY decided to
E-mail:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telephone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
Page 1 of 7
Privacy Protection Authority Registration number: IMY-2024-4541 2(7)
Date: 2024-06-07
close the supervisory case because the investigation showed that the company had
satisfied the complainant’s right of access and IMY therefore did not find any reason
for further investigation.
The complainant appealed IMY’s decision. The Administrative Court of Stockholm
decided in a judgement dated 12th of March 2024 with case number 21426-23 to
reverse IMY’s decision and referred the errand back to IMY for further investigation.
The administrative court found that the matter investigated did not only regarded, as
IMY has stated, the right of access but also the question the of whether the controller
had complied with its obligations under Article 12 of the GDPR. The case was referred
back to IMY for consideration of the need for further action in relation to its obligations
under Article 12.
The investigation in case IMY-2023-8282 shows that Etraveli Group determined the
purpose and means of the processing of personal data that the complaint concerns
and thus is the data controller. Because of that reason IMY has initiated supervision of
Etraveli Group and the continuing investigation of the complaint will be made in this
supervisory case.
Processing
The complaint was submitted to IMY that is the lead supervisory authority under Article
56 of the GDPR. The applicant resides in Estonia and the proceedings have been
carried out in accordance with the provisions of the GDPR on cooperation in cross-
border processing.
The case has been handled through written procedure. In the light of the complaint
concerning a cross border processing, IMY has used the mechanisms for cooperation
and consistency contained in chapter VII of the GDPR. The supervisory authorities
concerned have been the data protection authorities of Estonia, the Netherlands,
France, Norway, Poland, Hungary, Denmark, Ireland, Slovakia and Germany.
What Etraveli Group has stated
Etraveli Group has essentially stated the following. Etraveli Group has determined the
purposes and means of the processing of personal data relating to the complaint and
is thus the controller. Information about the controller, the rights of a data subject and
an instruction on how to exercise those rights (with contact information to the
company’s privacy team) was stated in Etraveli Groups privacy policy at the time of the
complainants transaction with the company. It is evident from the service Internet
Archive that the privacy policy, with that content, was held available at that time on the
site of the web portal that the complainant used to make his transaction with the
company. Thus Etraveli Group has provided an appropriate and user-friendly
communication channel in line with the GDPR. As evidence for this statement Etraveli
Group has handed in print screens from Internet Archive dated the 24th of January
2021 where it is stated that the website latest update was on the 21th of May 2018.
The complainant’s request of access was received on 27th May 2021. The
complainant’s request was handled, however, by the wrong customer service
department and, therefore, in an unsatisfactory, lengthy and unclear manner. When
initial contact with the complainant was made, the company’s customer service
representatives either did not recognise the messages as a request of access or failed
to handle the request successfully. Consequently, the applicant was not informed of
Page 2 of 7
Privacy Protection Authority Registration number: IMY-2024-4541 3(7)
Date: 2024-06-07
the delay until the case was brought to the right department in the company’s
organisation. During the relevant period, the company’s customer service was
extraordinary strained due to an unprecedented number of cancellations and changes
in flight departures because of the COVID-19 pandemic. The situation prompted the
rapid recruitment and training of a large number of inexperienced staff.
The applicant contacted Etraveli Group on 24 and 25 March 2021 by telephone. The
company records a certain percentage of telephone calls to and from customer service
for quality and educational purposes. Such recordings will be deleted after six months.
A regular customer service representative does not normally have permission to
access recorded calls but must escalate such a request to a superior. The telephone
conversations requested by the complainant does not appear to have been recorded,
but notes were made in the company’s CRM system. The complainant apparently
assumed that the conversations were recorded. After too long, he came into contact
with the company’s privacy team who replied that no recordings could be disclosed,
however without giving an explanation. He repeated his request, but it was denied
summarily and incorrectly. On a number of occasions, the customer service
recommended him to contact the company by telephone in order for the request to be
answered in a more comprehensible manner, since the communication in writing
seemed to have got stuck. No phone call was made. However, on 3 September 2021,
the request was escalated to a superior who checked that there were no call
recordings. The complainant’s request ended up with the right department, the privacy
team, on 23 September 2021. All personal data including all notes from the company’s
CRM system were provided to the complainant on 14th October 2021. The case shows
that Etraveli Group handled the complainant’s request for access correct and rapid as
soon as it reached the right department. If the applicant had used the contact details in
the company’s privacy policy, his request would undoubtedly have been handled
faster.
Etraveli Group trains all customer service employees on, among other things,
elementary data protection rules in order to ensure that request to exercise the right as
a data subject reaches the right department. If a customer service employee has
provided incorrect or insufficient information to a data subject, it is followed up to avoid
repeated behaviour.
What the complainant has stated
The complainant has been given the opportunity to comment on the Etraveli Group’s
statement and essentially stated the following. There is evidence that the request was
made as early as in March 2021. At the time of the request of access, there was no
information on who was the controller of the web portal he used, nor was there any
contact directions other than a chat function. The URL-address of the printscreens
from the Internet Archive isn’t the same as the one the company appointed to in the
booking confirmation for more information about how his personal data was handled. It
is unclear why he was partly provided access by receiving notes from the case, but
could not receive recordings of the phone calls. It is unlikely that the personal data was
partly collected by one controller and partly by another and that they claim that the
request was submitted trough the wrong channel. If data were shared between
regions/controllers, he should either have been informed or else it has been a data
protection issue if data was shared with a party that should not have had access. From
an unanswered letter dated 26th May 2021, sent both by email and to a postal address
shared by Gotogate and the Etraveli Group, it should have been clear that several
complaints had been made that had not been encountered for. That gave Etraveli
Page 3 of 7
Privacy Protection Authority Registration number: IMY-2024-4541 4(7)
Date: 2024-06-07
Group an additional opportunity to clarify issues regarding personal data liability which
they did not. The fact that the letter was not answered shows that they did not intend to
reply, regardless of the channel used to contact them. The shortcomings are part of a
systematic misconduct from the company.
Statement of reasons for the decision
IMY shall consider whether the complainant’s request of access has been in handled
by Etraveli group in compliance with Articles 12 and 15 of the GDPR.
The question of whether the complainant has been provided
access
The complainant is of the opinion that his request of access under Article 15 of the
GDPR has not been fully accomodated since he was not provided with recordings of
telephone conversations made with Etraveli Group’s customer service on 24 and 25th
of March 2021.
It follows from Article 57.1 f of the GDPR that IMY should handle complaints lodged by
data subjects who consider that the processing of his or hers personal data infringes
the regulation. It also follows that, to the extent appropriate, should investigate the
subject matter of the complaint. The CJEU has ruled that the supervisory authority
must investigate such complaints with due diligence.2
According to Section 23 of the national act förvaltningslagen (2017:900) an authority
must ensure that a case is investigated to the extent required by its nature.
IMY has put questions to the controller and received documents from both parties
regarding, inter alia, notes from Etraveli Group’s CRM system and email
correspondence held between the applicant and the customer service. Etraveli Group
states that the applicant’s request for access was met on 14 October 2021 and that he
received all his personal data, including all the notes from the CRM system.
Furthermore, Etraveli Group has stated that some customer service calls are recorded
and that these recordings are deleted after six months. According to Etraveli Group,
the telephone conversations in question have not been recorded, on the other hand,
the complainant has been provided with the CRM system-notes made about the calls.
It is apparent from correspondence submitted by the complainant that, after six months
had passed since the telephone conversation occurred, Etraveli Group stated to the
complainant that he cannot access recordings, since all recordings of telephone
conversations are deleted after six months. The applicant understood that statement
as a confirmation of that the calls were recorded but later deleted. However, it is
apparent from other documentation in the errand that on the third of September 2021,
that is to say less than six months after the conversations with the complainant took
place, the company noted in its CRM system that no recording of the conversations
took place.
IMY notes that Etraveli Group’s statement about that the telephone conversations has
not been recorded is supported by the notes from CRM systems that no such
recordings had been done. IMY considers that the investigation in the errand does not
support otherwise and therefore concludes that it is not apparent from the investigation
2Judgment in Schrems II, Case C-311/18, EU:C:2020:559, paragraph 109.
Page 4 of 7
Privacy Protection Authority Registration number: IMY-2024-4541 5(7)
Date: 2024-06-07
that Etraveli Group has failed to comply with Article 15 of the GDPR in the manner
claimed in the complaint. Taking into account the nature of the case and the fact that
the conversations in all circumstances would have been deleted after six months, IMY
considers that it is not justified to take further actions to investigate the question of
whether the calls were recorded or not. IMY has thus investigated the matter in this
respect to the extent required by Article 57.1 f of the GDPR and Section 23 of
förvaltningslagen.
The question of whether the complainant’s request was
satisfactorily dealt with
According to Article 12.2 of the GDPR, the controller shall facilitate the exercise of the
data subject’s rights under Articles 15 to 22.
According to Article 12.3 GDPR the controller shall provide information on action taken
on request under Articles 15 to 22 to the data subject without undue delay and in any
event within one month of receipt of the request. That period may be extended by two
further months where necessary, taking into account the complexity and number of the
requests. The controller shall inform the data subject of any such extension within one
month of receipt of the request, together with the reasons for the delay.
IMY finds that the investigation shows that Etraveli Group had stated in their privacy
policy, which was available at the time of the request on the website that the
complainant used to make his booking, that the data subject should contact the
company’s privacy team by a specific post- or e-mail address if they wanted to invoke
a right applicable under the GDPR. Hence, IMY does not find reasons to doubt that the
company has provided appropriate and user-friendly communication channels for the
exercise of the rights of the data subjects. Etraveli Group has stated that the
complainant’s request was initially handled by the wrong department and therefore
unsatisfactory, protracted and unclear to the complainant.The data subject does not
have to use the communication channel preferred by the controller. They also have the
possibility to make a request of access by contacting other official contact points of the
controller, such as the complainant has done.3 The investigation in the errand shows
that the complainant has had extensive and prolonged contact with Etraveli Group’s
customer service in order to, inter alia, have his request for access met and that he
has been given many different and sometimes equivocal answers to his request. IMY
considers that the applicant’s request for access was dealt with in a way that made it
difficult for him to exercise his right of access. Etraveli Group therefore acted in breach
of Article 12.2. of the GDPR by not facilitating for the complainant to exercise his right
of access.
The complainant states that he made his request of access already in March 2021.
However, IMY considers that the evidence submitted by the applicant only shows that
he was in contact with Etraveli Group at that time and not that the request was made
at that stage. However, the documentation supports that the complainant made his
initial request on the 27th of May 2021, which is also the date that he himself specified
in a statement to IMY made the 1th of June 2023, and that the request was met on the
14th of October 2021. With that IMY concludes that the applicant was provided access
to his personal data four and a half months after the date that Etraveli Group received
his request for access. Although the external limit for dealing with a request for access
may be extended in certain circumstances under Article 12.3, it requires that the data
3 European Data Protection Board (EDPB) Guidelines on the right of access – Guidelines 01/2022 on data subject
rights – Right of access, version 2.0 (finally adopted on 28 March 2023), paragraphs 52-56.
Page 5 of 7
Privacy Protection Authority Registration number: IMY-2024-4541 6(7)
Date: 2024-06-07
subject receives information of such delay and about the reasons for the delay within a
month of receipt of the request. It cannot be established that Etraveli Group has made
such a notification. IMY notes that Etraveli Group thus has processed personal data in
breach of Article 12.3 of the GDPR by not informing the complainant without undue
delay of the outcome of his request for access.
Choice of intervention
IMY has the possibility to target a number of measures, known as corrective powers,
where processing operations have infringed the provisions of the GDPR. It follows
from the Articles 58.2 and 83.2 of the GDPR that IMY has, inter alia, the power to
impose administrative fines pursuant to Article 83 of that regulation. In the case of a
minor infringement IMY may, as stated in recital 148 of the GDPR, issue a reprimand
pursuant to Article 58(2)(b) instead of imposing an administrative fine. Account must
be taken of aggravating and mitigating circumstances of the case, such as the nature,
severity and duration of the infringement as well as previous relevant infringements.
IMY notes the following relevant facts. Etraveli Group has dealt with the complainant’s
request of access in breach of Article 12.2–3 of the GDPR. However, as is apparent
from the investigation, the complainant had already obtained access to his personal
data before IMY initiated supervision in June 2023 on the basis of the relevant
complaint, which makes the infringement less serious than if the complainant’s request
was left unanswered. Furthermore, the infringement concerns only one person in an
individual case and Etraveli Group has not previously committed any breaches of the
GDPR. The breach has also occurred during a period when the company’s customer
service was profoundly burdened as a result of the COVID-19 pandemic. Against this
background, IMY considers that it is a minor infringement within the meaning of recital
148 and that Etraveli Group must be given a reprimand pursuant to Article 58.2 b of
the GDPR.
This decision has been made by Head of Unit after presentation by
legal advisor .
Page 6 of 7
Privacy Protection Authority Registration number: IMY-2024-4541 7(7)
Date: 2024-06-07
How to appeal
If you want to appeal the decision, write to IMY. Please indicate in the letter the
decision you are appealing and the amendment you are requesting. The appeal must
be received by IMY within three weeks from the date on which you received the
decision. However, if you are a party representing the public, the appeal must be
lodged within three weeks of the date on which the decision was issued. If the appeal
has been received in due time, IMY forwards it to the Administrative Court in
Stockholm for review.
You can email the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be subject to confidentiality. The authority’s contact
details are shown in the first page of the decision.
Page 7 of 7