PROTECTION OF PRIVATE LIFE AND TRANSPARENCY OF THE STATE
FOR INTERNAL USE
Information holder: Estonian Data Protection Inspectorate
Date: 20.09.2024
Valid until: 20.09.2099 and for p 2 until entry into force of
the Decision
Legal ground: Public Information Act § 35 (1) p.2, p.12
Berlin Commissioner for Data Ours 20.09.2024 nr 2.1-12/24/466-
Protection and Freedom of Information 1139-7
ARTICLE 60 FINAL ADOPTED DECISION
Reprimand and termination of the proceedings
Factual circumstances
On March 26, 2024, the Estonian Data Protection Authority (Estonian SA) received a complaint
from the data subject, (the Complainant), through the European Commission's
Internal Market Information System (IMI) against (the Controller). Since
the Controller has its main establishment in Tallinn, Estonia, Estonian SA has accepted the case
as LSA.
According to the Complaint, the Complainant has received emails from the Controller since
2022. The emails were sent to the Complainant’s e-mail address . The sent
emails contained information about trips, bills and news. The main reason the complaint was
lodged with the Berlin Commissioner for Data Protection and Freedom of Information, is that the
Complainant was not a customer of the Controller, had never registered with , nor provided
any information to the Controller. The Complainant wrote to the Controller on 25 of May 2022
requesting the deletion of his personal data. Since the emails continued to arrive, the
Complainant lodged the complaint with the data protection authority.
The Estonian SA’s proceedings
The Estonian SA initiated supervision proceedings on the basis of clause 56 (3) 8) of Personal
Data Protection Act and sent 8 of July 2024 to the Controller an inquiry regarding personal data
protection nr 2.1-12/24/466-1139-2. The aim of the inquiry was to clarify, whether the Controller
process the personal data of the Complainant and to clarify the purpose and legal basis for data
processing.
Pursuant to the complaint the Complainant sent a request to the Controller on 25 of May 2022
requesting the deletion of his personal data. Under Article 17 of the GDPR individuals have the
right to have personal data erased, which applies only in certain circumstances.
The Controller informed the Estonian SA that on May 25, 2022, their customer support team
received a request from the Complainant to erase his personal data. However, because the
Controller had recently changed the system used to handle customer requests, they are facing
difficulties in analyzing why the customer support employee responded as they did. Additionally,
on August 8, 2023, the Controller received another request from the Complainant regarding the
erasure of personal data. Unfortunately, due to a technical error, this request was not forwarded
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / registrikood 70004235
to the customer support team. The Controller's technical team is currently investigating this
issue.
Nevertheless, the Controller confirmed that the Complainant's email address
is no longer associated with any users on the platform and will not
receive any further emails. However, the Controller informed the Estonian SA that on April 3,
2024, the Complainant created a new account on the platform using a different email
address, which is . As a result, the Controller is processing the personal
data relevant to the new account in accordance with its privacy policy.
Given the above, the Controller has violated the requirements of the article 17 (1) of the GDPR.
The Complainant submitted requests to delete his personal data on May 25, 2022, and again on
August 8, 2023, but the Controller failed to delete the Complainant's personal data.
Since the Controller confirmed the deletion of the Complainant’s email address
to the Estonian SA on July 25 2024, the Estonian SA has issued a
reprimand to the Controller under Article 58(2)(b) of the GDPR. The Estonian SA considers this
measure sufficient, as the violation has been rectified.
In addition, the Estonian SA draw the Controller’s attention to the following:
1. The Controller should ensure that there are provided modalities for facilitating the
exercise of the data subject's rights under the GDPR, including mechanisms to request
and, if applicable, obtain, free of charge, in particular, access to and rectification or
erasure of personal data and the exercise of the right to object. The controller should also
provide means for requests to be made electronically, especially where personal data are
processed by electronic means. The controller should be obliged to respond to requests
from the data subject without undue delay and at the latest within one month and to give
reasons where the controller does not intend to comply with any such requests. Thus, the
Controller should implement additional changes to the internal handling of GDPR-based
requests to avoid situations like this in the future.
Based on above, the Estonian SA will terminate the proceedings concerning the protection of
personal data in this matter.
This administrative act can be disputed within 30 days by:
- submitting a challenge to the Director General of the Data Protection Inspectorate
pursuant to the Administrative Procedure Act or
- filing a petition with an administrative court pursuant to the Code of Administrative
Court Procedure.
Respectfully,
Lawyer
authorized by Director General
2 (2)