Omit the personal information in case of publication
(Article 24 of internal regulation No 1
August 2013)
Register of measures
No 294 of 9 May 2024
THE SECRETARY GENERAL
Mattei
# THE ITALIAN DATA PROTECTION AUTHORITY ("GARANTE")
At today's meeting, which was attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice-President, Mr. Agostino Ghiglia and Mr. Guido Scorza, Members and Mr. Fabio Mattei, Secretary-General;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter 'the Regulation');
HAVING REGARD TO Legislative Decree No 196 of 30 June 2003 (Personal Data Protection Code, hereinafter 'the Code') as amended by Legislative Decree No 101 of 10 August 2018 laying down 'Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679';
HAVING REGARD TO the complaint of 16 November 2021 alleging an alleged breach of personal data by Vivid Money GmbH;
CONSIDERING the cooperation mechanism with the other European data protection authorities activated by this Authority, as provided for in the Regulation (Article 60 et seq.) for the cross-border processing of personal data, and in particular the Article 56 IMI procedure opened on 8 April 2022 for the identification of the lead authority in current proceedings;
WHEREAS the authority in Berlin ("BInEDI") has declared itself to be the Lead authority, Vivid Money GmbH having its main establishment in Germany, Berlin, and this authority has declared itself to be "concerned authority" in this procedure, as the authority receiving the complaint;
HAVING REGARD TO the "draft decision" shared by the Berlin authority with the other concerned supervisory authorities on 18 January 2024;
HAVING EXAMINED the documents in the file;
HAVING REGARD TO the observations made by the Secretary-General pursuant to Article 15 of Regulation No 1/2000 of the Garante;
The rapporteur was Mr. Agostino Ghiglia;
# FOREWORD
# 1. The complaint and the investigation
The case stems from a complaint lodged with this authority by [REDACTED] in which he complained about an alleged unlawful processing of his personal data by Vivid Money GmbH, established in Berlin, Zimmerstrasse 78, 10117, Germany, for having been denied the opening of a bank account through the Vivid Money App, without any explanation,
1
and for not having received an adequate response to requests to exercise the rights to access and to delete his personal data by Vivid Money GmbH (hereinafter ‘Vivid Money’), a company providing mobile banking and investment apps also on Italian territory and to which the Vivid Money App is attributable.
After informing the data subject (by letter of 26 January 2022) of the need to activate the cooperation mechanism with the other European data protection authorities pursuant to the Regulation, we sent the complaint to the Berlin authority (‘BInBDI’), the Lead authority, to initiate the investigation of the case and verify the lawfulness of data processing by Vivid Money.
By IMI procedure ‘Exchange of relevant information’, on 18 January 2024, the Berlin Authority shared a preliminary draft decision with regard to Vivid Money, giving an account of the investigation carried out and its position on the matter. In particular, in the reply provided to BInBDI, the company stated that: “Vivid does not have any data that prevents the creation of accounts” and further that “the specific data and information that the complainant seeks relates to processes that are in the responsibility of [REDACTED] bank” and that “we have answered all the complainant’s questions in our capacity [...]”.
Taking into account the information gathered, also in the light of the documentation produced by Vivid Money, the Berlin authority came to the conclusion that Vivid Money had not acted in breach of the Regulation and that, therefore, the investigation procedure could be said to have been completed.
In particular, on the basis of the information provided, BInBDI stated that it could not establish a violation of the Regulation in the data processing by Vivid Money, specifying that it had ascertained the facts summarized below:
After the data subject was refused an account opening request via the Vivid Banking App in September 2021 and requested information on the reason for the refusal, Vivid Money provided feedback after a few days to inform him that “unfortunately, due to internal policies and the policies and guidelines of our customer identification partners, we are unable to offer you our service”.
Vivid Money also informed the data subject by e-mail that it would delete his data as soon as the minimum retention period had been reached and replied to the data subject’s repeated request, confirming that it was unable to provide the specific reason for refusing to open the account, by sending him the feedback obtained from [REDACTED] bank, its partner bank [REDACTED] response read: “Unfortunately, due to the technical and administrative requirements of this product, at the moment we are not able to offer you this service”, clarifying that ‘[REDACTED] bank took care of verifying the request to open the account, since the account would have been opened there’.
Finally, the subsequent deletion of [REDACTED] (further) data from Vivid Money was confirmed by Vivid Money by email of 12 November 2021.
Having taken note of the investigation carried out by the Berlin Authority and of its conclusion, this authority informed the interested party, sending him, on the one hand, the documentation received from the German authority and inviting him, on the other hand, if appropriate, to send any objections or observations to this authority within 10 days.
Since no objections or observations were received from the interested party, this authority communicated its agreement with the assessments of the Berlin authority, which, on 23 February 2024, shared with the other concerned authorities the draft decision relating to the procedure in question, the conclusion of which, in summary, is:
2
- the data subject made a specific request for access to Vivid Money, i.e. requested only the data relating to the refusal to open an account with App Vivid;
- Vivid Money responded to this request by three successive emails informing the data subject that it could not provide any more precise information than that the partner bank could not open the account (providing feedback from the partner bank);
- an appropriate reply was therefore provided within one month in accordance with Article 12(3) of the Regulation. The reasons for refusing to open an account are not known to Vivid Money, so Vivid Money is unable to disclose them; it also replied to the request for cancellation within one month;
- at the request of the Berlin Authority, Vivid Money provided the still available data, which was sent to the data subject via the Italian authority;
- in the present case there has not been a breach of data protection rules by Vivid Money and it is proposed that the case be closed.
## 2. Assessments by this Authority (“Garante”)
In the light of the findings of the investigation, and in the light of the documentation received, we considered that we should endorse the findings of the Berlin authority: in fact, Vivid Money GmbH has not been found to have infringed data protection rules, and has responded promptly to requests to exercise the data subject’s rights (in accordance with Article 12 of the GDPR), justifying the impossibility of providing the specific data requested by the complainant.
Therefore, taking the view that there was no need to raise objections to the proposed draft decision of the Berlin authority, this authority agreed with the proposal of the lead authority.
As no relevant and reasoned objections were raised to the draft decision of the Berlin Authority under Article 60 para. 6, the same became binding on the authorities concerned (CSA).
## ALL THE FOREGOING, THE “GARANTE”
pursuant to Article 60(8) of the Regulation and Article 143(3) of the [Italian Data Protection] Code, Articles 11(1)(b), 14 and 18 of Regulation No 1/2019 of the Garante on internal procedures with external relevance for the performance of the tasks and exercise of the powers conferred on the Italian Data Protection Authority, concludes the present proceedings and dismiss the complaint, as Vivid Money GmbH has not been found to have infringed the data protection rules.
The Garante, pursuant to Article 60(8) of the Regulation, notifies the complainant of this decision and communicates it to the controller through the Berlin authority.
3
Pursuant to Article 78 of the Regulation and Article 152 of the Code, an appeal may be lodged against this decision with the ordinary judicial authority.
Rome, 9 May 2024
THE RAPPORTEUR
GHIGLIA AGOSTINO
Garante per la protezione dei dati personali
COMPONENT
14.05.2024 14:27:01 GMT+00:00
THE PRESIDENT
PASQUALE STANZIONE
Garante per la protezione dei dati personali
PRESIDENT
21.05.2024 09:36:08 GMT+01:00
THE SECRETARY-GENERAL
FABIO MATTEI
Garante per la protezione dei dati personali
SECRETARY-GENERAL
13.05.2024 09:16:43 GMT+01:00
4