BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
Our reference: LDA-1085.1-306/20-F INOFFICIAL TRANSLATION
Reference Sweden: IMY-2023-15275
IMI draft decision: 683906
Controller:
On the basis of the draft decision of the Swedish Integritetsskyddsmyndigheten (IMY) no. 683906, the
Data Protection Authority of Bavaria for the Private Sector (BayLDA) pursuant to Article 60(8) of the GDPR
issues the following
Final Decision:
The complaint is rejected.
Justification:
The complaint was received by the BayLDA on 30.12.2019 and was forwarded via IMI to the IMY as the
lead data protection supervisory authority for the controller.
On 13.09.2024, the IMY submitted the draft decision no. 683906 to the concerned supervisory authorities
with the following contents:
Decision of the Swedish Authority for Privacy Protection
The Swedish Authority for Privacy Protection (IMY) finds that (556737-0431) has not processed the
complainant’s personal data in breach of Article 6(1) of the GDPR1 in the manner alleged by the complainant in
the complaint.
Case closed.
Presentation of the supervisory case
IMY has initiated supervision regarding ( or the company) due to a complaint. The complaint
has been submitted to IMY, as lead supervisory authority for the company's activities pursuant Article 56 of the
General Data Protection Regulation (GDPR). The handover has been made from the supervisory authority of the
country where the complaint has been lodged (Germany). The transfer has taken place in accordance with the
provisions of the GDPR on cooperation in cross-border processing.
The case has been handled through written procedure. In light of the complaint relating to cross-border pro-
cessing, IMY has used the mechanisms for cooperation and consistency contained in Chapter VII of the GDPR. The
concerned supervisory authorities have been the data protection authorities in Germany, the Netherlands, Nor-
way, France, Finland, Denmark and Ireland.
The complainant has essentially stated the following:
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
On 18 February 2019, the complainant made an online purchase using as a payment solution. The com-
plainant paid for the goods. The complainant then withdrew the purchase and then made a new purchase from
the same supplier for a higher amount. The complainant paid the difference. then submitted the claim to
debt collection, even though, according to the complainant, the debt was settled. In connection with this,
also transferred the complainant’s personal data to the debt collection agency. According to the complainant,
was not entitled to process his personal data in the manner that had occurred.
has essentially stated the following:
is the controller concerning the processing to which the complaint relates.
The current purchase
It is not true that the claim in question was settled. considers that the complainant has attempted to settle
another debt with the same trader and has not paid the amount of the invoice in question. This has resulted in an
automatic refund being made by . The complainant would have had to contact customer service (which was
later done) in order to settle the debts in this way.
Submission of the claim to debt collection
The process is designed as such that the claim is handed over to debt collection after it has fallen due for payment
and the customer has not paid in accordance with the agreement the customer has with Before the claim
was handed over, made several attempts to collect the debt on its own, but failed. Before the debt is
handed over, contacts the customer through several channels; emails, push notifications and letters. When
hands over the claim to debt collection, they also hand over the customer's contact and identification infor-
mation, information about goods and services purchased and information about the use of 's services (i.e.
information about the purchase and claim). The debt collection agency needs the information to be able to iden-
tify the debt and the customer, to be able to contact the customer and to be able to collect the claim. If
omitted the aforementioned information, it would not be clear to the debt collection agency which claim is re-
ferred to or who the customer is.
Purpose of the processing
The purpose of the processing has been to collect the claim through outsourcing to a third party, a debt collection
agency.
Legal basis for processing
has based the processing on a legitimate interest pursuant to Article 6.1 f of the GDPR. has assessed
that they have a legitimate interest in recovering claims. According to , the processing has been necessary
to achieve the purpose. has designed their process in a way that balances the complainant’s interests with
’s interests. In their balancing of interests, has taken into account that the debt has passed the due
date, that the customer has not paid in accordance with the agreement, that has tried to collect the debt
on its own, that the
purpose of the processing has been to collect the claim and that the processing ceases when the debt is settled.
In the light of the foregoing, concludes that the complainant’s interests do not override their interests in
recovering the debt.
Communication in the case
On 29 November 2023 and 12 February 2024 respectively, IMY communicated ’s reply to the relevant na-
tional supervisory authority of the country where the complainant lodged the complaint (Germany) in order to
give that complainant the opportunity to comment on the investigation of the case. On 12 March 2024 and 12
September 2024 respectively, the German data protection authority announced that the complainant was given
the opportunity to comment, but didn’t reply.
Motivation for the decision
Applicable provisions, etc.
According to Article 6.1 of the GDPR, in order for the processing to be lawful, the controller must be able to sup-
port the processing of personal data on a lawful basis. The controller may process personal data on the basis of
Article 6.1 f of the GDPR if the controller (1) has a legitimate interest, (2) the processing of personal data is neces-
sary to achieve the legitimate interest pursued and (3) the interest or fundamental rights and freedoms of the data
subject are not overridden.2
It follows from Article 57.1 f of the GDPR that IMY must process complaints from data subjects who consider that
their personal data are being processed in breach of the GDPR. The provision further states that IMY shall, where
appropriate, examine the subject matter of the complaint. The Court of Justice of the European Union has stated
that the supervisory authority must investigate such complaints with due diligence. 3
The Swedish Authority for Privacy Protection assessment
On the basis of the complaint in the case, IMY has only examined 's conduct in the individual case and
whether the processing in question can be based on a legal basis. The supervision does not cover whether
's personal data processing is otherwise compatible with the General Data Protection Regulation.
IMY has not analysed whether there is a right of set-off under German law, nor taken a position on a possible dis-
pute concerning the complainant's obligation to pay the claim. IMY’s assessment is that it is also not appropriate
for IMY to investigate a dispute under German law. IMY therefore considers that the case is investigated to the
extent required by Article 57.1 f of the GDPR.
Legitimate interest
The first question to be considered by IMY is whether has had a legitimate interest in the processing.
Recital 47 of the GDPR lists a number of examples of legitimate interests, one of which is that there may be a le-
gitimate interest where there is a relevant and appropriate relationship between the data subject and the control-
ler in situations such as the data subject is a client or in the service of the controller. This list is not exhaustive. An
opinion on the application of legitimate interest from the Article 29 Group 4 (2014) states that an interest is justi-
fied when it is lawful, sufficiently specific and represent a real and present interest.5
The Court of Justice of the European Union has held that the recovery of claims in the prescribed manner by an
assignee may constitute a legitimate interest justifying the processing of personal data within the meaning of Arti-
cle 6.1 f of the GDPR.6 The European Data Protection Board (EDPB) has also stated in a guideline 7 on the pro-
cessing of personal data under Article 6.1 b GDPR in the context of the provision of online services to data sub-
jects that 6.1 b can be used to support the processing of personal data necessary in the context of a normal con-
tractual relationship, such as sending formal reminders about outstanding payments or correcting errors or delays
in the performance of the contract. The opinion of the Article 29 Group8 also states that processing of basic infor-
mation of the data subject, such as name, address and reference to outstanding contractual obligations, to send
formal reminders should be considered as falling within the processing of data necessary for the performance of a
contract. It is further stated the opinion that with regard to more elaborated processing of data, which may or may
not involve third parties, such as external debt collection, or taking a customer who has failed to pay for a service
to court, it could be argued that such processing does not take place anymore under the ‘normal’ performance of
the contract and would therefore not fall under Article 7(b) in the directive 95/46. However, this would not make
the processing illegitimate as such: the controller has a legitimate interest in seeking remedies to ensure that his
contractual rights are respected. Other legal grounds, such as Article 7(f) in the directive 95/46. could be relied
upon, subject to adequate safeguards and measures, and meeting the balancing test.
The complainant has in the complaint stated that the debt already was settled when submitted the claim to
debt collection. In its reply dated 19 January 2024, stated that the debt in question was not settled, but that
2 Judgment of the Court of Justice in TK, C-708/18, EU:C:2019:1064,paragraph 40
3 Judgment of the Court of Justice of the European Union in Schrems II, Case C-311/18,EU:C:2020:559, paragraph 109.
4 The so-called Article 29 Working Party was an advisory and independent working group composed of representatives of the EU and EEA super-
visory authorities. The task of the group was to contribute to the uniform application of the Data Protection Directive through, inter alia, recommen-
dations. The Working Party has been replaced by the European Data Protection Board (EDPB) on 25 May 2018
5 Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC
6 Judgment of the Court of Justice of the European Union in M.I.C.M., C-597/19, EU:C:2021:492,paragraph 109
7 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data
subjects
8 Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC
it was another debt which the complainant sought to resolve. IMY considers that has a legitimate interest in
handing over its claim for recovery with the help of a debt collection agency. The investigation has revealed noth-
ing other than that the debt has been submitted for recovery in the prescribed manner. IMY finds that in
this case has a legitimate interest and that this is lawful, sufficiently specific and represent a real and present inter-
est.9
Is the processing necessary for the legitimate interest?
The second question to be considered by IMI is whether the processing of the complainant’s name, contact details
and details of the debt was necessary to process by handing over to the debt collection agency for the purpose to
recover the debt.
As regards the condition relating to the necessity of processing personal data, it should be borne in mind that
derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly
necessary.10 Furthermore, it follows from recital 39 of the GDPR that personal data should be processed only if the
purpose of the processing could not reasonably be fulfilled by other means. It also follows from the case-law that
the requirement of necessity must be examined in conjunction with the ‘data minimisation’ principle enshrined in
Article 5.1 c of the GDPR.11
has stated that it processed information about the complainant’s name, contact and identification data,
information about goods and services purchased and information about the use of ’s services (i.e. infor-
mation about the purchase and the claim). has stated that this information was necessary in order for the
debt collection agency to be able to identify the debt and the customer, to be able to contact the customer and to
be able to collect the claim.
IMY does not find that has collected more information than was necessary for the collection agency to be
able to contact the complainant and for the collection agency to have the necessary information about the debt in
order to be able to recover the claim. IMY’s assessment is that the recovery of the claim could not reasonably have
been fulfilled as effectively by other means which could have been less detrimental to the complainant’s funda-
mental rights and freedoms.12 IMY therefore concludes that the processing was necessary to achieve the purpose.
Balance of interests
The last question IMY has to consider is whether the complainant’s interest in not having his data processed out-
weighs ’s interest in recovering the claim.
In particular, as is apparent from recital 47 of the GDPR, the interests and fundamental rights of the data subject
could in particular override the interest of the data controller where personal data are processed in circumstances
where data subjects do not reasonably expect further processing.13 According to the Court of Justice, account
must be taken, inter alia, of the nature of the personal data at issue, in particular of the potentially sensitive nature
of those data.14
IMY finds that the company's interest in recovering its claims weighs heavily. IMY takes the view that has
weighed their interests against those of the complainant and presented their reasoning behind their balancing
assessment to IMY. IMY takes the following into account as stated by in their assessment. In their balancing
of interests, has considered that the debt has passed the due date, that the customer has not paid in ac-
cordance with the agreement, that has tried to collect the debt on their own, that the purpose of the pro-
cessing has been to collect the claim and that the processing ceases when the debt is settled. IMY also took ac-
count of the fact that the categories of data processed by were not sensitive or particularly worthy of pro-
tection and that the complainant could reasonably have expected that would process his name, contact
details and information about the debt in order to recover their claim. Furthermore, according to IMY, it is also in
the complainant’s interest that the debt collection agency’s claim is correctly calculated and that, for that reason,
9 Ibid
10 Judgment of the Court of Justice in Rīgas satiksme, C-13/16, EU:C:2017:336, paragraph 30
11 Judgment of the Court of Justice in Meta platforms, C-252/21, EU:C:2023:537, paragraph 109
12 Ibid, paragraph 108
13 Ibid, paragraph 112
14 Judgment of the Court of Justice in TK, C-708/18, EU:C:2019:1064, paragraph 57
the debt collection agency has been provided with the necessary information on the debt. Furthermore, according
to IMY's assessment, it is currently a well-established practice to enlist the help of a debt collection agency for col-
lection and something that the individual can reasonably expect. IMY considers that the interests or fundamental
rights of the data subjects do not override 's interest in processing the data for the purpose of pursuing the
claim.
IMY therefore concludes that the case is investigated to the extent that it is appropriate in the circumstances, and
that the investigation does not support that has processed the complainant’s personal data in breach of
the GDPR in the manner alleged in the complaint.
The case should therefore be closed.
As the concerned supervisory authorities (including BayLDA) did not object to this draft decision, the
BayLDA hereby adopts this draft decision as final decision in accordance with Article 60(8) of the GDPR.
Ansbach, 21.10.2024