ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
INTERNAL INFORMATION
Information holder: Estonian Data Protection Inspectorate
Date: 19.06.2024
Valid until: 19.06.2098
Legal ground: Public Information Act § 35 (1) p.2,
p.12
SA Spain Ours 19.06.2024 nr 2.1.-1/24/85-182-6
ARTICLE 60 FINAL DECISION
Notice of termination of proceedings concerning the protection of personal data
Estonian Data Protection Inspectorate (Estonian DPI) received a complaint from Spanish citizen
(Complainant) through European Commissions Internal
Market Information System (IMI) against (Controller, ). Since the
Controller has its main establishment in Tallinn, Estonia, Estonian DPI has accepted the case as
LSA.
According to the complaint, the Complainants’ personal data (debt information) was transmitted
to a Spanish payment default registry
( payment default registry). The Complainant claims
that he has not been notified about the disclosure of this data at payment default registry.
According to the Complaint, the Complainant claims that he found out about the disclosure of
his data at 18.05.2023 after which he contacted the Controller and requested explanations
regarding the processing of his data but received no answer. The Complainant has objected to the
processing of his personal data (disclosing his debt data at ).
Estonian DPI initiated supervision proceedings on the basis of clause 56 (3) 8) of Personal Data
Protection Act and sent several inquiries to the Controller. The aim of supervisory proceedings
was to clarify the purpose and legal basis for data processing (data transfer to third parties);
whether appropriate measures were taken to provide necessary information referred to in GDPR
Article 13 to the Complainant and whether Article 15 GDPR Right of Access was met by the
Controller.
CONTROLLER´S EXPLANATIONS
1. The Complainant has digitally signed a loan agreement nr with
on 19.01.2023.1 The signed loan agreement was sent to the Complainant´s e-mail address
after signing and is also available through ´s portal.
2. The payment defaults origin from the loan agreement that the Complainant has entered
into with the Controller. The first repayment according to the payment schedule2 of the
loan agreement nr was due on 27.01.2023 with the amount of 78.35 EUR.
received a late payment of 10 EUR on 30.01.2023, 1 EUR on 31.01.2023 and
67.48 EUR on 06.02.2023. Next payment was due on 28.02.2023 with the amount of
1
Appendix 1 – loan agreement
2
Appendix 2 – payment schedule
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / registrikood 70004235
119.93 EUR, received 79 EUR on 06.03.2023 and 12 EUR on 12.03.2023 so the
first debt occured. After that the Complainant was late repaying next three monthly
payments and eventually did not repay them. The Controller terminated the loan contract
as per the loan agreement p. 13.2 on 29.06.2023.
3. uses an automated debt data processing system, where debt information is
regularly communicated to the debtor via SMS, e-mails, automated telephone calls. In
addition to that, debt collectors communicate with the clients on daily basis reminding
them their duties to repay the debt or negotiate the repayment terms. has been in
constant communication with the Complainant – ´s log file proves that tens of
3
reminders, notifications, and repayment options have been sent to him. Additional
notifications about the debt were sent to the Complainant on 01.03.2023 via e-mail and
02.03.2023 via SMS (log entries can be found in log file).
4. On 17.03.2023 , acting on behalf of the Controller, sent the Complainant a postal
letter (using the address that the Complainant had provided to the Controller) through
registered post with the debt information and a notification that if the debt will not be
cleared in 15 days, it will be disclosed at payment default registry. This might
cause the Complainant´s future loan applications to be rejected. No errors occured
according to the Controller when delivering the letter.4
5. On 04.04.2023 the Controller sent the Complainant an additional notification via postal
letter (using the address that the Complainant had provided to the Controller) through
registered post notifying him about the next steps regarding debt collection actions, also
about the possible disclosure of his data to payment default registry in case the
debt is not repayed in 30 days.5 The Complainant was also offered a chance to reschedule
the payments or ask for a payment holiday, however the Complainant did not wish to use
this opportunities. The confirmation from the postal service is attached.6
6. The Controller sent the debt data of the Complainant to on 07.04.2023. On
10.04.2023 has sent the Complainant a notification regarding the disclosure of
his debt data at payment default registry. A confirmation from has been
7
attached. The debt data was disclosed at on 10.04.2023.
7. The loan agreement (Appendix 1) that the Complainant signed states under p. 13 that
has the right to transmit the information to payment default registry when the
repayments are not made on time: Following a payment overdue or default under the
Loan Agreement, the Lender shall have a right, in each case pursuant to the applicable
law, to notify the Borrower thereof and send the following information to the chosen
Payment Default Register: 1) given name and surname of the Borrower; 2) national
identification number of the Borrower; 3) commencement and end date of the payment
default; 4) the total amount of the payment default; and 5) data concerning the nature of
the contractual relationship from which the arrears arise. The Payment Default Register
shall have the right to communicate the aforementioned data on the basis of a contract
entered into for an indefinite period to other credit providers and other persons who have
a legitimate interest concerning the creditworthiness of the persons entered in the
register and collect a charge therefor.
3
Appendix 3 – Sent notifications
4
Appendix 4 – Certified letter (ESP); Appendix 4a – English translation
5
information available in Sent notifications (App.2)
6
Appendix 5 – confirmation
7
Appendix 10 – Certificate; Appendix 10a – English translation
2 (5)
8. On 19.07.2023 the Controller received the Complainant´s request to which the Controller
replied on the same day8.
9. On 20.07.2023 a similar request was received through to which the Controller
9
replied on the same day. All the documentation requested by the Complainant was sent
to him (documents, loan agreement and debt certificate)10 and a compromise proposal
was offered.
10. Another similar request was received through on 03.08.2023 to which the
Controller replied on the same day.11
11. On 16.10.2023 another similar request was received through post to which the Controller
replied on 24.11.2023 adding all the documentations concerning the loan and debt and all
the sent notifications.12
ESTONIAN DATA PROTECTION INSPECTORATE´S OPINION
12. Estonian DPI explains that it only assesses whether the processing of personal data has
been lawful in terms of GDPR and shall not assess the lawfulness of the debt claim itself.
Estonian DPI does not have the competence to assess whether the contracts are valid
lawfully, what the claims consist of, whether the debt has actually been liquidated,
whether or not the rules for the assignment of the claim have been complied with, as
those are disputes that arise from contractual relations. Settlement of contractual disputes
between private parties is a matter for the civil court.
13. Pursuant to GDPR Art 6(1) processing shall be lawful only if and to the extent that at
least one of the legal bases stated in Art 6(1) applies. The Controller stated that the legal
basis for processing Complainant’s personal data falls under Art 6 (1)(b) of GDPR –
processing is necessary for the performance of a contract. The Controller and
Complainant signed a loan agreement nr on 19.01.2023. Processing personal
data is necessary for the Controller in order to pursue the claim.
14. Pursuant to GDPR Art 6(1)f) of processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data subject which
require protection of personal data. According to the Controller – Complainant´s debt
data was transmitted to the payment default registry on 07.04.2023 on the basis
of GDPR Art.6(1)f).
15. In order to rely on GDPR Art.6 (1)f) as a legal basis of processing, the Controller should
be able to demonstrate that their or third party´s legitimate interest overrides the impact
on individuals´ interests and rights and freedoms. This requires a balancing test that
compares the controller´s and the data subjects’ interests or fundamental rights and
freedoms, which the Controller has conducted.
16. is a creditor who offers different loans to data subjects. Consequently,
’s interest is to claim the debts. If the data subject has not fulfilled their
obligation and has failed to make loan payments, as a Controller has an interest
to share that information with payment default registry. The purpose of the debt data
transfer to payment default registry is a disclosure of personal data related to a breach of
8
Appendix 6 – 25.07.2023 answer (ESP); Appendix 6a – English translation)
9
Appendix 7 - 20.07.2023 answer (ESP)
10
Appendix 7a – documents; Appendix 7b – loan agreement; Appendix 7c – debt certificate; Appendix 7d – English
translation
11
Appendix 8 – 03.08.2023 answer (ESP), Appendix 8a – English translation
12
Appendix 9 – ´s answer (ESP), Appendix 9a – answer documents; Appendix 9b – data; Appendix 9c –
English translation; Appendix 9d – cover letter(ESP); Appendix 9e – English translation
3 (5)
debt relationship to third parties to enable them to verify the reliability of a person
regarding fulfilling his financial obligations and to fulfil the obligation of responsible
lending arising from the law when assessing the creditworthiness. The processing is not
only in the interest of but the market of civil transactions in general.
17. In order to rely on GDPR Art.6 (1)f) as a legal basis of processing the Controller´s or
third party´s interests cannot be overridden by the fundamental rights and freedoms of the
data subject. Complainants’ interest is to protect their personal data and to be treated
equally to other people who do not have payment difficulties. However, person´s right to
the protection of personal data is not an absolute right, it must be considered in relation to
its function in society and be balanced against other fundamental rights, in accordance
with the principle of proportionality. Payment default registry’s purpose is to give third
parties an opportunity to assess the creditworthiness of the data subject and therefore
protect transaction reliability. When the data subject fails to make loan payments, the
creditor has a legitimate interest to transmit personal data to the payment default registry.
Estonian DPI considers the legitimate interest (GDPR Art.6 (1)f) as a valid legal basis for
disclosing the data to the payment default registry.
18. Pursuant to GDPR Art 13(3) - where the controller intends to further process the personal
data for a purpose other than that for which the personal data were collected, the
controller shall provide the data subject prior to that further processing with information
on that other purpose and with any relevant further information as referred to in
paragraph 2 to ensure fair and transparent processing. Pursuant to GDPR Art 13(4) –
paragraphs 1,2 and 3 shall not apply where and insofar as the data subject already has the
information.
19. The Controller has explained during the investigation that the information about
Controller´s right to transmit the debt information to payment default registry when the
repayments are not made was made available to the Complainant in the loan agreement.
20. Secondly, the Complainant was made aware about the possible data disclosure via postal
letters (sent to the address that he provided to the Controller) on 17.03.2023, 04.04.2023,
10.04.2023.
21. Thirdly, ´s log file proves that numerous reminders, notifications, and repayment
options have been sent to the Complainant.
22. As a conclusion Estonian DPI finds that the Controller has fulfilled their obligation to
inform the data subject about the further processing of his data (in terms of disclosing his
data to the payment default registry).
23. Pursuant to GDPR Art 15(1) the data subject shall have the right to obtain from
the controller confirmation as to whether or not personal data concerning him or her are
being processed, and, where that is the case, access to the personal data and information.
24. The Complainant claimed that after finding out about the disclosure of his debt data at
payment default registry, he contacted the Controller and requested explanations
regarding the processing of his data but received no answer.
25. The Controller has confirmed to Estonian DPI that they have received Complainant´s
requests on 19.07.2023, 20.07.2023, 03.08.2023, 16.10.2023 and have replied to all of
them. The Controller has sent proof that confirm this.
26. Pursuant to GDPR Art 21(1) the data subject shall have the right to object at any time, on
grounds relating to his or her particular situation, to processing of personal
data concerning him or her which is based on point (f) of Article 6(1).
The controller shall no longer process the personal data unless the controller
demonstrates compelling legitimate grounds for the processing which override the
interests, rights and freedoms of the data subject.
27. The Complainant signed a loan agreement with but did not fulfil his obligations
to repay the loan. The Controller has confirmed and proved that the processed data is
correct and data subject was adequately informed of the processing.
28. Based on all the evidence that the Controller has presented during this investigation and
taking into consideration that Complainant´s arguments were overruled by Controller´s
4 (5)
arguments, Estonian DPI is of the opinion that the processing of the Complainant´s debt
data has been lawful, and that the complaint should be rejected.
Based on above, Estonian DPI will terminate the proceedings concerning the protection of
personal data in this matter.
Footnote reference documents will be annexed to relevant documents.
This administrative act can be disputed within 30 days by:
- submitting a challenge to the Director General of the Data Protection Inspectorate pursuant to
the Administrative Procedure Act13 or
- filing a petition with an administrative court pursuant to the Code of Administrative Court
Procedure14 (in this case, any challenges submitted in the same case can no longer be processed).
Respectfully,
Lawyer
authorized by Director General
Appendixes:
Appendix 1 – loan agreement
Appendix 2 – payment schedule
Appendix 3 – sent notifications
Appendix 4 – Certified letter (ESP)
Appendix 4a - Certified letter (ENG)
Appendix 5 – Confirmation 04.04.2023
Appendix 6 – 25.07.2023 answer (ESP)
Appendix 6a – 25.07.2023 answer (ENG)
Appendix 7 – 20.07.2023 answer (ESP)
Appendix 7a – Answer 20.07.2023_ZIP
Appendix 7b - Answer 20.07.2023 ZIP and files
Appendix 7c – Certificado de Deuda 20.07.2023
Appendix 7d – 20.07.2023 answer (ENG)
Appendix 8 – 03.08.2023 answer (ESP)
Appendix 8a – 03.08.2023 answer (ENG)
Appendix 9 – Respuesta sobre la Peticion recibida el 16 de Octubre de 2023
Appendix 9a – 24.11.2023 Answer documents
Appendix 9b – Datos de Base
Appendix 9c – _24.11.2024 answer to the request (ENG)
Appendix 9d - 24.11.2023 cover letter (ESP)
Appendix 9e - 24.11.2023 cover letter (ENG)
Appendix 10 – Certificada (ESP)
Appendix 10a – Certificate (ENG)
13
https://www.riigiteataja.ee/en/eli/527032019002/consolide
14
https://www.riigiteataja.ee/en/eli/512122019007/consolide
5 (5)