BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
Our reference: LDA-1085.1-10725/21-F
IMI Art. 56: 372705
INOFFICIAL TRANSLATION
IMI draft decision: 665453
Controller:
On the basis of the draft decision of the Austrian data protection authority (AT DPA) No. 665453, the Data
Protection Authority of Bavaria for the Private Sector (BayLDA) pursuant to Article 60(8) of the GDPR is-
sues the following
Final Decision:
The complaint is rejected.
Justification:
The complaint was received by the BayLDA on 14 October 2021 and was forwarded via IMI to the AT DPA
as the lead data protection supervisory authority for the controller.
On 12 July 2024 the AT DPA submitted the draft decision no. 665453 to the concerned supervisory au-
thorities with the following contents:
The data protection authority decides on the data protection complaint of […] (complainant)
dated 23 September 2021 against (opponent) regarding an infringement
of the right of access, right to erasure, notification obligation regarding rectification or erasure of
personal data or restriction of processing and right to object as follows:
- The complaint is dismissed.
Legal bases: Articles 15, 17, 19, 21, 51(1), 57(1) lit. f and 77(1) of Regulation (EU) 2016/679 (General
Data Protection Regulation, GDPR), ABL. Nr. L 119, 4.5.2016; §§ 18(1) and 24(1) and (5) of the Data
Protection Act (DSG), Federal Law Gazette I No 165/1999; § 147 of the Tax Code in the version
published on 1 October 2002 (Federal Law Gazette I, p. 3866; 61), which was last amended by Article
24 of the Law of December 22, 2023 (Federal Law Gazette 2023 I No 411) (dAO); Section 257 of the
Commercial Code, in the amended version published in the Federal Law Gazette, Part III, No. 4100-1,
which was last amended by Article 34(1) of the Law of December 22, 2023 (Federal Law Gazette 2023
I No 411) (dHGB).
JUSTIFICATION
A. Arguments of the parties and procedure
1. The Austrian Data Protection Authority was informed on 25 February 2022 via the Internal Market
Information System (IMI) of the complainant’s complaint lodged with the Bavarian Supervisory Authority
on 23 September 2021, completed on 14 October 2021.
By letter of 23 September 2021, originally submitted to the Bavarian Supervisory Authority, the
complainant submitted in summary that on 3 September 2021 she had received an unauthorised
request for payment from , .
Therefore, at 11:21 a.m. on 6 September 2021, she called the telephone number indicated on the letter
and tried to clarify the matter. It was only with considerable effort that it was possible to locate the
person who allegedly drew up an invoice and ultimately sent it to the complainant, even though he was
not entitled to do so, as she had objected to any disclosure to third parties. Since she had already had
great problems in the past due to similar false statements by third parties, she had objected to this
treatment by the management and asked them to give a written answer. To date, she has received
neither a written answer nor a telephone call.
The address given to the veterinary practice in
and no other. The address used by the opponent was incorrect. The amount stated is
not owed.
She wanted the complete erasure of her data from the opponent, the complete erasure of the data from
the data source and the data recipients, and access to data recipients. She also raises an objection to
the processing of the data by the opponent and the company Idexx.
2. By letter of 14 October 2021, the complainant also stated that it was not understood at all why this
data had to be stored if this was based on an unjustified processing of data.
3. By letter of 30 September 2022, the opponent submitted that, on 23 March 2021, it had been
commissioned by its client to enforce the following claim concerning the complainant:
Invoice number 401119140 of 29 August 2019- EUR 35, 65 with the address
. In this case, the complainant is mentioned personally in the specifications. There is no
reference to the dental practice and with the address
.
By letter of formal notice relating to the above-mentioned file number of 24 March 2021, the opponent
requested the complainant to pay the outstanding claim. However, the letter of formal notice sent to
could not be served.
After several unsuccessful address determinations, the correct address of the complainant could have
been determined by the . The first letter of formal notice was sent
again to the newly registered address on 3 September 2021.
On 6 September 2021, the opponent was contacted by telephone by a third person, presumably
, on the debt collection act at issue. Due to the lack of power of attorney, the caller was
not given any telephone information on the debt collection act for data protection reasons.
On 8 September 2021, the opponent received the complainants’ fax.
Due to the denial, the client was contacted. The latter had informed the opponent that the
present claim had been wrongly handed over to the complainant due to a recording error and that the
present order had to be cancelled on the basis of this. The recording error was in the hands of the
treating veterinarian, who had already transmitted incorrect data. As a result, the invoice was incorrectly
drawn up by the client with regard to the address given.
On 4 October 2021, the reply was sent by registered post within the statutory period relating to the data
protection request. According to ’s consignment details, the letter was duly served on 7 October
2021. This letter had been addressed to the complainant, since, firstly, only the complainant had been
personally mentioned in the specifications, secondly, there was no corresponding power of attorney for
and, thirdly, the letter of formal notice of 3 September 2021 had been sent to the
complainant. A confusion of persons had been ruled out, since the complainant had not disputed the
provision of services by the veterinarian in its letter of 8 September 2021. Apparently, according to the
complainant, the address of the dental practice was given to the veterinarian. The opponent was not
able to verify this statement, since the contracting entity did not have a laboratory order at the time of
the inspection. Therefore, the letter of 4 October 2021 was sent by registered mail to
. Since there was only one address, which was obviously an incorrect address, it was not only
admissible, but also necessary to determine a serviceable address of the complainant.
By letter of 4 October 2021, the complainant was refused the erasure of her data, stating its reasons.
The personal data stored about the complainant relating to file number 50302-/55388-* had been
processed in connection with the provision of debt collection services and thus the business purpose.
The opponent’s branch in provides debt collection services in Germany as a registered legal
service provider and must therefore comply with the German provisions to which it is subject. Since the
opponent is subject to the statutory provisions of tax and commercial law with regard to the personal
data of the complainant stored with it and this circumstance therefore precludes erasure, the
complainant was refused erasure on the basis of further data processing for archiving and proof
purposes. The restriction of the processing of personal data pursuant to Article 18 GDPR was
confirmed.
By letter of 4 October 2021, the complainant was also provided with information about the data
recipients and was informed that the aforementioned companies were the responsible bodies for the
data stored there within the meaning of the data protection regulations and therefore also have to
independently examine the claims for deletion and provide corresponding information in accordance
with the GDPR. The data was passed on to the listed companies for the purpose of address
determination. A negative credit rating entry to a credit reference agency had not been carried out.
Since the personal data of the complainant had not been deleted, no communication under Article 19
GDPR to the data recipients had taken place.
4. By letters of 28 October 2022 and 31 October 2022 respectively, the complainant summarised and
essentially argued that it still could not understand the claim ‘after several unsuccessful address
determinations’. In the past, she had received invoices from both the veterinary practice
and the company itself, with the postal address
.
She received the laboratory invoice sent to her. However, the date of 20 August 2019 set out
therein is in line with the treatments included in the veterinary invoice of 23 August 2022 (Note: it was
2019). The veterinary practice indicated as the billing
address.
After the veterinary treatment of her dog on 16 August 2019, her husband and she went to the company
in to hand over the sample in person, as the samples had to be taken to the laboratory
as quickly as possible. A cash payment of the laboratory costs was not possible. In October 2019, she
was then sent the announced laboratory invoice to the address . In that
laboratory invoice, no date was indicated under the item ‘Date of performance’. She added that
laboratory invoice to the veterinary invoice of 23 October 2019 and asked her brother to transfer the
amount.
There would be no general assignment of payment to the laboratory or a signed rejection,
because the veterinary practice writes a new examination form for Idexx every time a new laboratory
order is placed.
In the computer system of the veterinary practice, her current address, , was noted
and so this had also been passed on. The error was not at the veterinarian's office.
5. By submission of 4 May 2023, the opponent stated that it had requested its client to
reexamine and comment on the facts. Searching the Internet for the address
and the following page: was
found.
According to this page, , Office Organisation Consultancy, can be found at the
address ‘ ’. The complainant had informed its processor of this
circumstance and asked whether it was responsible for the error with the wrong address and whether
the address data of the aforementioned person named had been used in the invoicing
process. The contracting authority had indicated that it had included the address data ‘
’ from the practice in , but unfortunately it no longer had the order
forms or laboratory orders. According to the client, the person in the garden field has
nothing to do with the invoices. After telephone consultation of the client with the veterinary practice
on 4 May 2023, it was confirmed that there was no second in the data at
and that the previous old address of was also and that
this was changed.
The veterinary invoice of 23 August 2019 contains the list of the two checks and sampling carried out
on different days. According to the contracting entity, for each new order, an order form or laboratory
invoice is completed by the treated veterinarian and signed by the animal owner.
In the case of the original invoice No 401119148 of the invoice 401154390 of 4 October 2019, the
address data were only handed over to the client by the veterinary practice
. However, this invoice 401119148 was returned to the client and then correctly amended to
. The new corrected invoice 401154390 refers to the number of the original invoice
401119149 under the laboratory number. That bill was also paid. In the case of invoice 401119140, no
invoices and reminders were returned to the client. Therefore, the veterinary practice had not been
contacted and the case had been handed over to the complainant. The contracting entity could not find
receipt of payment for invoice 401119140. According to the contracting entity, the latter had received
only two laboratory assignments in respect of the appellant. In this regard, two invoices 401154390 and
401119140 were drawn up. The contracting entity could not understand ’s invoice of 24 October
2019.
The complainant was not responsible for recording the wrong address. The present debt collection case
was withdrawn from processing shortly after the client's cancellation notification in September 2021 and
the complainant's personal data were restricted in processing. By letter of 4 October 2021, the appellant
had already been informed of the address determinations carried out at several companies. Only after
negative multiple address determinations did the company provide
information on the address . With regard to the assignment of payment to
the laboratory mentioned by the appellant or the objection to the transfer of data, reference is
made to a reference on the invoice. The fact of the assignment of claims is brought to the attention of
the invoice recipient and thus also the passing on of the data by the treating veterinarian to the client.
The fact that the data must be passed on by the veterinarian to the client is absolutely necessary for
the submission of the laboratory service and invoicing by the client.
6. By submission of 26 May 2023, the appellant stated, in summary, that before the start of treatment,
it had had its former and no longer valid address in changed to the correct address ob-
tained
at the veterinary practice . It had also been entered correctly into the computer by the employee
at the registration. She was assured by the veterinary practice that her address had been entered
correctly in the computer software and that it had been correctly passed on to . She never received
the invoice 401110140.
B. Subject matter of the complaint
Based on the complainant’s submissions, the subject matter of the appeal is whether the opponent
infringed the complainant’s right to data access (limited to data recipients), the right to erasure and the
obligation to notify, and the right to object.
C. Findings of fact
The facts of the case are as follows: The opponent is a debt collection company with its head office in
Austria and a branch office in Germany.
On 23 March 2021, the opponent was commissioned by to enforce the following claim
concerning the complainant: Invoice number 401119140 of 29 August 2019, EUR 35.65 with the
address ‘ ’.
By letter of formal notice of 24 March 2021, the opponent requested the complainant to pay the
outstanding claim. The letter of formal notice sent to the address ‘ ’
could not be served.
After several unsuccessful address determinations, the letter was sent again to the address ‘
’ on 3 September 2021. The letter is as follows:
Pursuant to Article 15 (1) (c) of the GDPR, a data subject has the right, as laid down by the EU
legislature, that the controller must provide information on which specific recipients or categories of
recipients have been disclosed their personal data.
In Case C-154/21, the European Court of Justice ruled that, even when exercising a right of access
pursuant to Article 15 of the GDPR, the data subject has a real right to choose, unlike Articles 13 and
14 of the GDPR, so that the data subject must be able to choose whether the controller provides the
data subject with either – if possible – information on the specific recipients to whom that data has been
disclosed or information on categories of recipients. Furthermore, the data subject must be able to verify
not only that the data concerning him or her are correct, but also that they are processed lawfully, in
particular that they have been disclosed to recipients authorised to process them (see, by analogy,
judgment of 7 May 2009, Rijkeboer, C-553/07, EU:C:2009:293, paragraph 49). In order for the data
subject to exercise further data subject rights (Articles 16, 17, 18 and 21 GDPR) in an effective manner,
it is necessary to know the identity of the specific recipients.
In its letter of 4 October 2021, the opponent stated as follows:
“With regard to the disclosure of your personal data, we inform you that we have carried out an
address determination on the basis of the incorrectly received data. We received a negative result
from the companies and
, , ,
, , . We have received your address data
from .’
It was found that the opponent informed the complainant not only about abstract categories of
recipients, but also about the specific recipients, which is why no defectiveness of the information can
be detected in this point.
Article 17 GDPR
By letter of 8 September 2021, the complainant specifically stated the following to the opponent: “We
ask you to completely delete all data from and about us from you, any third party to whom you have
disclosed it and where you have received it.”
Under Article 17(1) of the GDPR, in principle, every data subject has the right to request the erasure of
personal data from a controller. The controller must delete the data in accordance with Article 17(1) of
the GDPR, provided that one of the aforementioned reasons pursuant to Article 17(1)(a) to (f) of the
GDPR applies and that there are no exceptions pursuant to Article 17(3) of the GDPR.
Pursuant to Article 17(1) (a) GDPR, a data subject has the right to request the controller to erase his or
her data without undue delay if the data are no longer necessary for the purposes for which they were
collected or otherwise processed.
However, in accordance with paragraph 3 (b), the controller may refuse such a request for erasure to
the extent that the processing of the data is necessary ‘for compliance with a legal obligation which
requires processing by Union or Member State law to which the controller is subject or for the
performance of a task carried out in the public interest or in the exercise of official authority vested in
the controller.!
The opponent processes the complainant’s data in connection with the provision of debt collection
services within the meaning of Section 2(2) of the RDG and relies on the (further) storage obligations
that apply to it, in particular pursuant to Section 147 of the German Banking Code (DAO) and Section
257 of the German Commercial Code (DHGB), which provide for a six or ten-year storage obligation.
On the basis of the legal obligation in the dAO and dHGB, the opponent must agree that the storage of
the personal data in question is necessary for the fulfilment of the legal task assigned to the opponent
or obligations imposed on it by law.
Even if it seems annoying to the complainant – comprehensible to the data protection authority – that
her personal data will continue to be stored by the opponent despite cancellation of the claim, it cur-
rently appears necessary to leave a personal reference to the complainant in the sense of accounting
verifiability and comprehensibility.
As a result, the opponent rightly did not comply with the complainant’s request for erasure at this stage.
The appeal was therefore also to be dismissed on this point.
Article 19 GDPR
According to Article 19 GDPR, the controller shall communicate any rectification or erasure of personal
data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to
each recipient to whom the personal data have been disclosed, unless this proves impossible or
involves disproportionate effort. The controller shall inform the data subject about those recipients if the
data subject requests it
It follows from what has already been said about Article 17 GDPR that there is no unlawful data
processing at issue and therefore no erasure of the data is to be carried out by the opponent. There is
therefore already no obligation to inform the recipients of the deletion pursuant to the first sentence of
Article 19 GDPR.
For the sake of completeness, it should be noted that an obligation to notify in connection with the
deletion of personal data to the controllers cannot be inferred from the data origin/data sources of the
GDPR.
Article 21 GDPR
By letter of 8 September 2021, the complainant specifically stated the following: ‘We hereby object to
the use and retention of our data.’
Pursuant to Article 21 GDPR, a data subject has the right to object at any time, for reasons arising from
his or her particular situation, to the processing of his or her personal data on the basis of Article 6 (1)
(e) or (f) GDPR. The controller may then not further process these data, unless it can demonstrate
compelling legitimate grounds for the processing which override the interests, rights and freedoms of
the data subject, or for the establishment, exercise or defence of legal claims.
According to Article 6 (1) (e) GDPR, processing is lawful if it is necessary for the performance of a task
carried out in the public interest or in the exercise of official authority vested in the controller. In
accordance with Article 6 (1) (f) of the GDPR, processing is lawful if it is necessary to safeguard the
legitimate interests of the controller or a third party, unless the interests or fundamental rights and
freedoms of the data subject which require the protection of personal data prevail, in particular where
the data subject is a child.
However, as already stated above, the complainant processes the appellant’s data in question on the
basis of a legal obligation within the meaning of Article 6 (1) (c) GDPR and an objection is denied
success for this reason alone.
The appeal had to be dismissed in its entirety, es was therefore to be decided in accordance with the
opposition.
As the concerned supervisory authorities (including BayLDA) did not object to this draft decision, the
BayLDA hereby adopts this draft decision as final decision in accordance with Article 60(8) of the GDPR.
Ansbach, 26.08.2024