7 October 2024
J.No. 2023-7329-0018
Doc.no. 647028
Caseworker
Sent by Digital Post
Final decision pursuant to Article 60(8) of the GDPR The Danish Data
Protection Agency
1. The Danish Data Protection Agency (hereinafter ‘Danish DPA’) hereby returns to the case Carl Jacobsens Vej 35
where you lodged a complaint with the Danish DPA on 11 December 2018 regarding iZettle’s 2500 Valby
Denmark
disclosure of your personal data.
T 3319 3200
[email protected]
The Danish DPA has considered that the case involves cross-border processing of personal datatilsynet.dk
data, which means that the case has been handled in cooperation with the supervisory author- VAT No. 11883729
ities of the other EU Member States.
The complaint originally concerned iZettle whose main business was established in Sweden.
On this basis, the Swedish supervisory authority (hereinafter ‘Swedish SA’) was designated
as lead supervisory authority. In October 2020, iZettle merged with PayPal, which therefore
became the controller of the processing operations, including those previously carried out by
iZettle.
PayPal’s main business is established in Luxembourg. Therefore, it was no longer the Swedish
SA, but instead the Luxembourg supervisory authority (hereinafter ‘Luxembourg SA’) that was
designated as the lead supervisory authority in accordance with Article 56 GDPR.
The Danish DPA therefore forwarded the complaint to the Luxembourg SA. The Luxembourg
SA has dealt with the matter and examined the circumstances in more detail. The case has
been handled in accordance with the procedure laid down in Article 60 of the GDPR.
The examination has been carried out in English as the complaint has been dealt with by the
Luxembourg SA. You are welcome to contact the Danish DPA if you need help with translating
into Danish.
On 12 September 2022, you received a letter from the Danish DPA forwarded from the Lux-
embourg SA. You were asked to provide your comments to the letter. The Danish DPA con-
tacted you again on 24 October 2022 in order to receive your comments to the letter.
The letter from the Luxembourg SA states, among other things, that you have requested ac-
cess and subsequently asked for the deletion of the data about you that the company pro-
cesses. As iZettle has deleted the information about you before merging with PayPal (including
information about your access request), PayPal may not be aware of your access request and
may also never have processed your personal data.
Furthermore, the Luxembourg SA stated in the letter that PayPal's privacy policy appears to Page 2 of 5
answer your questions about the processing of your personal data.
You did not return with your comments to the letter from the Luxembourg SA.
2. As you have not responded to the letter from the Luxembourg SA, the Danish DPA adopts
the Luxembourg SA’s decision to dismiss the complaint pursuant to Article 60(8) of the GDPR.
The Danish DPA has emphasised the statement from the Luxembourg SA which is set out
below:
“1. In the framework of the European cooperation, as provided for in Chapter VII of
Regulation (EU) 2016/679 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation or GDPR), the
Supervisory Authority of Denmark submitted to the National Data Protection
Commission (hereinafter: “the CNPD”) the complaint of Mr A.L. (national reference
of the concerned authority: 2021-7329-0040) via IMI in accordance with Article 61
procedure - 188636.
2. The complaint was initially lodged against the company izettle (‘iZettle’), who had
its main establishment in Sweden. In October 2020, the company iZettle has been
absorbed by the company PayPal (Europe) S.à r.l. et Cie (‘PayPal’), which
therefore became the data controller for the processing activities previously
performed by the company iZettle. The company PayPal has its main
establishment in Luxembourg. As a consequence, under Article 56 GDPR, the
Supervisory Authority of Sweden is no longer competent to act as the lead
supervisory authority, and the CNPD is competent to act as the lead supervisory
authority. The Supervisory Authority of Denmark has therefore transferred the
complaint previously handled by the Supervisory Authority of Sweden to the
CNPD.
3. The original IMI claim stated the following:
“The data subject has lodged a complaint to the Danish Data Protection Agency
about iZettle’s processing of personal data. According to the data subject izettle
has in connection with a credit card payment disclosed the data subject’s phone
number to a café owner in Denmark without any apparent legal ground.”
4. In essence, the complainant states that he contacted the company iZettle in order
to obtain information about the source of collection of his phone number and the
legal ground of the disclosure of this phone number to a third party, being a
merchant using the payment terminal provided by the company iZettle in the
context of the provision of a payment receipt. While the complainant obtained the
deletion of his personal data by the company iZettle, he received no answer to
these questions. Thus, he asks the CNPD to further clarify this case since he finds
this practice of transferring personal data to a third party without his consent worrying
and against data protection rules.
5. The complaint is therefore based on Articles 5 (1) (a), 6 and 15 GDPR.
1. Applicable legal provisions
6. Article 77 GDPR provides that “without prejudice to any other administrative or
judicial remedy, every data subject shall have the right to lodge a complaint with
a supervisory authority, (...) if the data subject considers that the processing of Page 3 of 5
personal data relating to him or her infringes this Regulation.”
7. Pursuant to Article 5 (1) (a) of the Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation)
("GDPR"), personal data shall be “processed lawfully, fairly and in a transparent
manner in relation to the data subject (‘lawfulness, fairness and transparency’).
Article 6 (1) GDPR specifies the conditions for the lawfulness of processing.
8. In accordance with Article 15 of the GDPR “The data subject shall have the right
to obtain from the controller confirmation as to whether or not personal data
concerning him or her are being processed, and, where that is the case, access
to the personal data and the following information (...)”
9. Article 56(1) GDPR provides that “(...) the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing
carried out by that controller or processor in accordance with the procedure
provided in Article 60”;
10. According to Article 60(1) GDPR, "The lead supervisory authority shall cooperate
with the other supervisory authorities concerned in accordance with this Article in
an endeavour to reach consensus. The lead supervisory authority and the
supervisory authorities concerned shall exchange all relevant information with
each other”;
11. According to Article 60(3) GDPR, "The lead supervisory authority shall, without
delay, communicate the relevant information on the matter to the other
supervisory authorities concerned. It shall without delay submit a draft decision to the
other supervisory authorities concerned for their opinion and take due account of their
views”;
2. In the present case
12. In this case, the CNPD informed the supervisory authority of Denmark of its
conclusion at the issue of the assessment of the complaint via IMI 61 VMN
procedure 420061.
In particular, the CNPD assessed that:
• The complainant has sent this data subject access request to the company iZettle
in 2018 and received an answer from this company at that time. The additional
question left unanswered, while related to the lawfulness of the abovementioned
processing activity, is written in a vague way that does not identify it clearly as
being part of a formal data subject access request;
• The complaint mentions that iZettle was able to delete the complainant’s personal
data in 2018, with as consequence that these personal data were no more pro-
cessed by the company iZettle from that time;
• the company iZettle has been absorbed by the company Paypal in October 2020, Page 4 of 5
which therefore acts as the data controller for the processing activities previously
performed by the company iZettle. This absorption occurred after the company
iZettle had answered the initial data subject access request submitted by the com-
plainant and deleted his personal data in 2018, with as consequence that the
company PayPal may not have been aware of this data subject access request,
and would never have processed the complainant’s personal data which would
have been deleted before the absorption;
• the privacy policy published on the current “Zettle by PayPal” website
(https://www.zettle.com) contains a specific section providing information about
the processing of end-users data, in particular in the context of the receipt provi-
sion:
“How do we use it (Purpose of processing) : Provide receipts. You can choose
to have a receipt sent to you via e-mail or text message when you pay for the
services and/or products provided by any of our Merchants who uses Zettle in its
physical store. If you provide your e-mail address or mobile number to a Merchant
who uses Zettle, we will remember your details for the next time you buy some-
thing from a Merchant who uses Zettle in its physical store, if you use the same
payment card. This is regardless of if you have previously bought something from
this Merchant or not. This means that your e-mail address or mobile number will
be pre-filled in the receipt view for your convenience the next time you buy some-
thing from a Merchant who uses Zettle in its physical store. We will only use your
e-mail address or mobile number to send receipts to you. We will not use your
contact details for any other purpose, and will not share them with anyone else,
without obtaining your written consent first or inform you prior to initiating any
processing for new purposes or a purpose that is compatible with the purpose for
which we collected the personal data, all in accordance with applicable laws and
regulations. Please note that we have an easy way for you to opt-out from receiv-
ing any further receipt when you purchase something from a Merchant in its phys-
ical store. Just follow the link in the receipt you have received to opt-out from
receiving further receipts. We may also process your e-mail to provide a receipt
to you for the services and/or products provided by a Merchant in its Online Store.
Legal basis for the processing (Why the data processing is necessary): To pursue
our legitimate interest.”
Based on this assessment, the CNPD concluded that contacting the company PayPal
in the context of the present complaint would imply to provide it with personal data
from the complainant that it possibly never has collected, which appears not neces-
sary taking into account that the processing of the complainant’s data would have
ended in 2018, and that the privacy policy published on the current “Zettle by PayPal”
website provides information that answers the complainant’s question raised following
iZettle’s initial response to his data subject access request.
13. According to this conclusion, the CNPD requested the supervisory authority of
Denmark to get back to the complainant in order to:
• provide him with that conclusion and the information contained in the abovemen-
tioned privacy policy; and
• suggest to him that he introduces a new data subject access request directly to
PayPal by using the contact details provided within iZettle’s privacy policy in the
case where, taking into account these conclusion and information, he would have
additional questions about the processing of his personal data by PayPal in the Page 5 of 5
context of the abovementioned processing activity
14. The supervisory authority of Denmark replied that it did not receive any further
reply from the complainant.
3. Outcome of the case
15. The CNPD, in a plenary session, therefore considers that in the light of the fore-
going, it seems appropriate to dismiss the complaint as per Article 60(8) GDPR.”
The Danish DPA adopts the decision pursuant to Article 60(8) of the GDPR.
3. Concluding remarks
The Danish DPA considers the case closed and does not take any further action.
The decisions of the Danish DPA cannot be brought before any other administrative authority,
cf. Section 30 of the Danish Data Protection Act 1. However, the decisions of the Danish DPA
can be brought before the Danish courts, cf. Section 63 of the Danish Constitution.
The Danish DPA publishes decisions regularly on the Danish DPA’s website in pseudony-
mised form. If this decision is published, it will be in a way where individuals are not immedi-
ately identified.
Kind regards
1
Act No. 502 of May 2018 on supplementary provisions to the regulation on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data (the Data Protection Act). A translated version is available
here. Only the Danish version of the text has legal validity.