INTERNAL INFORMATION
Information holder: Estonian Data Protection
Inspectorate
Date: 16.08.2024
Valid until: 16.08.2099
Legal ground: Public Information Act § 35 (1) p.2,
p.12
The State Data Protection Inspectorate Ours 16 of August 2024 nr 2.1.-
1/23/1226-2996-10
Final decision
Reprimand and termination of the proceedings
Factual circumstances
Estonian Data Protection Authority (Estonian SA) received a complaint from Lithuania citizen
(the Complainant) through European Commissions Internal Market
Information System (IMI) against (the Controller) on 20 of October 2023.
Since the Controller has its main establishment in Tallinn, Estonia, Estonian SA has accepted the
case as LSA.
According to the Complaint, the Complainant got a request in the Controller’s app to submit a
passport’s data. Namely, the Complainant got a notification: Please confirm your identity. Should
you wish to keep using ‘ ’ services, you must confirm your identity. This way, we aim to ensure
the protection of your account. The Complainant was of the opinion that because of using
company’s account there is no reason to submit the requested data. Thus, he started the
conversation with the Controller via the chat on 1 February 2023. The Controller answered the
question and specified, that the additional information is needed in order to ensure the secure
execution of the Complainant’s payments.
Due to the fact that the Complainant was not satisfied with the answer received he started a new
conversation via the chat on 2 March 2023. The aim of this request was to get to know about the
legal ground for processing the requested data (passport’s data), the certain purpose for processing
and explanations, why without the data it is not possible to the Complainant to continue using the
service. In addition, the Complainant warned the Controller that if they do not provide the required
information, the Complainant will submit a complaint to the supervisory authority. The Controller
responded that the identity confirmation process is for ensuring the security of the passenger’s
account and making sure that a third party is not using their account. The system records the
Complainant’s payments and should banking issues arise, in order to ensure the safety of the
account, the verification of the account is automatically applied. Verification is automatically
assigned to the person in accordance with certain suspicious payment transactions. The system
automatically determines and appoints the travel prices and verification to the passengers, so the
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / registrikood 70004235
Controller cannot influence these functions. The identification process is meant to ensure security
on ‘ ’ platform.
Since the Controller did not provide the information the Complainant asked, he lodged a complaint
to the State Data Protection Inspectorate regarding possible violations of the Controller in the
processing of personal data of the data subject, by not providing information in accordance with
Article 12 (1) to (5) and 13 (1) (c) of the General Data Protection Regulation (GDPR).
The Estonian SA’s proceedings
The Estonian SA initiated supervision proceedings on the basis of clause 56 (3) 8) of Personal Data
Protection Act and sent 24 of January 2024 to the Controller an inquiry regarding personal data
protection nr 2.1.-1/23/1226-2996-3, in which the Estonian SA asked for clarifications about the
following:
What is a legal basis and purposes for the user's passport data processing. If the requirement
to provide a copy of the passport depends on the country in which the service is offered,
please indicate all countries where users are required to provide a copy of the passport with
reasons.
Please provide a link to the privacy policy, which provide data subjects with information
about the personal data being processed, including the submitting of a copy of the passport.
Please explain how the Controller fulfills the requirements set in the Article 5(1) (b) and
(c) of the GDPR when processing a copy of the user's passport.
Please explain why the Controller has not provided the Complainant with an exhaustive
answer regarding the processing of his personal data, i.e. has not explained to the
complainant the legal basis and purposes for which the copy of his passport is being
processed.
The Controller respond to the inquiry on 19 of February 2024, in which explained that the
Controller does not demand a users’ copy of passport, but the user have a choice to submit any of
the national identity documents. Also, there is no specific requirements about submitting the copy
of passport. The identity verification procedure is a key part of 's anti-fraud and security efforts
to ensure the integrity of user accounts.
The Controller processes identity documents for the following purposes:
authentication and verification of the user's account and identity; and
prevent, detect and block fraudulent accounts or the use of our services by unauthorized
users.
The Controller relies on its legitimate interests (Section 3 of the General Privacy Notice for
Passengers and Passengers1) when processing personal data to detect fraudulent payments and
security incidents, as it is in our interest to prevent and handle fraud, unauthorized use of
accounts and violations of our terms and conditions.
The Controller confirmed that carries out its data processing operations in accordance with
the principles set out in Article 5(1)(b) and (c) of the GDPR:
- Specific, necessary and legitimate objective: the collection of identity data in the form of
2 (5)
government-issued identity documents is adequate, relevant and limited to what is
necessary for effective and reliable identification. In this regard, we underline that reliable
and accurate verification of the user is only possible on the basis of documents issued by
the government. We underline that documents issued by the government are only used for
identification purposes and will not be further processed in a way that is contrary to these
purposes.
- Minimisation: the collection and processing of personal data on government-issued
identity documents can no longer be minimised ( cannot require any part of such a
document without affecting the authenticity of the document). In addition, does not
collect or process other data contained in such identity documents for any other purpose.
Regarding the case described in the Complaint the Controller explained that in March 2023 the
Complainant contacted ’s customer service to enquire whether had a legal basis to obtain
documents for identity checks. Unfortunately, the customer service representative was unable to
escalate this issue to the privacy team and the request was not handled in accordance with a
company’s processes. Since then, the Controller have given further instructions to the customer
support agent so that this situation does not happen again. In addition, the Controller provided the
Complainant with a comprehensive reply concerning the processing of his personal data on 22
February 2024 (during the supervision proceedings). Namely, the Controller explained to the
Complainant on what legal basis and for what purposes a copy of an identity document was
processed.
In the above mentioned respond to the Complainants the Controller explained the following: 's
Fraud team has detected suspicious activity related to your business payment method. This, in
turn, triggered the identity verification process to ensure you were the rightful owner of the
account. For safety considerations, we cannot disclose what exactly triggers our fraud monitoring
system to prevent users from abusing the system.
We hope you found this information useful and easy to understand. If you have any additional
questions, please contact our Customer Support Team by replying to this email. You can also find
additional information in our relevant privacy notice available at:
Within the framework of the Estonian SA, in order to obtain additional information about the case
referred to in the Complaint and to ascertain the lawfulness of the processing of personal data
carried out by the Controller, on 4 of Mart 2024 the Estonian SA addressed the Controller with a
relevant inquiry nr 2.1.-1/23/1226-2996-7 and asked for the analysis of the legitimate interests of
the Controller about the processing of users’ identification document. The Controller provided the
Estonian SA with the requested analysis.
Opinion of the Estonian SA
In accordance with the legal framework, any processing of personal data by the controller must be
legally justified by applying at least one of the legal bases provided for in Article 6(1) of the GDPR,
as well as by complying with the basic principles laid down in Article 5(1) of the GDPR.
Otherwise, the processing of personal data carried out shall be considered unlawful and must not
be carried out.
3 (5)
After evaluating the information referred to in the Complaint and received within the framework
of the Estonian SA, the Estonian SA established that the Controller processes the personal data of
the data subject and information related thereto to the extent necessary specified in the legislation.
The Estonian SA did not find that there were any violations in the processing of personal data
carried out by the Controller, i.e., for data processing performed by the Controller, the appropriate
purpose and legal basis is indicated. Moreover, by processing the data subject's data to a lesser
extent, it would not be possible to achieve the intended purpose of processing by the Controller.
Taking into account the above-mentioned, the Estonian SA concludes that the processing of the
personal data of the data subject by the Controller is legal and conforms to the basic principles laid
down in Article 5 and the legal bases of Article 6 of the GDPR.
At the same time, Article 12(1) to (4) of the GDPR provides for an obligation for the controller to
inform the data subject within one month2 of the actions taken upon receipt of the data subject's
request for the exercise of the rights laid down in Articles 15 to 22 or the reasons for not taking
such actions thereby ensuring provision of transparent information and communication with data
subjects. On the other hand, it follows from Article 12(5) of the GDPR that, where requests from
a data subject are manifestly unfounded or excessive, in particular because of their repetitive
character, the controller may charge a reasonable fee or refuse to act on the request, demonstrating
that the request is manifestly unfounded or excessive.
Regarding the submitted to the Estonian AS Complaint the Controller received the Complainant’s
request on 1 February 2023. The Complainant lodged a complaint to the State Data Protection
Inspectorate regarding the Controller's failure to provide the Complainant with a comprehensive
reply to his request. After the Estonian SA got the complaint and initiated supervision proceedings
the Controller sent the comprehensive reply to the Complainant in February 2024.
Based on the above, the Controller has violated the requirements of the article 12 (3) and article
15 (1) of the GDPR. Given that:
1. The Controller has assured that in the future, responses to data subjects will be provided in
a clear and understandable manner.
2. In the opinion of the Estonian SA, the Complainant received the answers to the questions
raised in the Complaint.
Thus, the Estonian SA reprimands the Controller on the basis of the article 58 (2) (b) of the GDPR,
and draw attention to the following:
1. The Controller shall take appropriate measures to inform the data subject of the processing
of personal data in accordance with the article 15 of the GDPR in a concise, transparent,
intelligible, and easily accessible form, using clear and plain language (the article 12 (1) of
the GDPR).
2. The Controller shall provide the data subject with a report on the action taken on the
application in accordance with Articles 15 to 22 without undue delay, but no later than one
month after receipt of the application. That period may be extended by two months, if
necessary, taking into account the complexity and number of the requests. The controller
shall inform the data subject of any such extension and the reasons for the delay within one
2
That period may be extended by a further two months, taking into account the complexity and number of requests,
informing the data subject of any such extension and of the reasons for the delay within one month of receipt of the
request.
4 (5)
month of receiving the application (article 12 (3) of the GDPR).
Based on above, the Estonian SA will terminate the proceedings concerning the protection of
personal data in this matter.
This administrative act can be disputed within 30 days by:
- submitting a challenge to the Director General of the Data Protection Inspectorate pursuant
to the Administrative Procedure Act or
- filing a petition with an administrative court pursuant to the Code of Administrative Court
Procedure.
Respectfully,
Lawyer
authorized by Director General
5 (5)