BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
Our reference LDA-1085.3-3068/21-I
IMI Art. 61 320241
IMI draft decision 651534
Controller
Date of receipt of complaint BayLDA 11.03.2021
On the basis of the draft decision of the National Data protection Commission Luxemburg (LUX SA) No.
7.482, the Data Protection Authority of Bavaria for the Private Sector (BayLDA) pursuant to Article 60(8) of
the GDPR issues the following
Final Decision:
The complaint is rejected.
Justification:
The complaint was received by the BayLDA on 11 March 2021 and was forwarded via IMI to the LUX SA as
the lead data protection supervisory authority for the controller.
On 24 June 2024 the LUX SA submitted the draft decision no. 651534 to the concerned supervisory au-
thorities with the following contents:
IMI Article 61identification of LSA and CSA entry 320241
IMI Case Register entry 50619
National file number LDA-1085.3-3068/21-I
Controller
Date of receipt of complaint BayLDA 11.03.2021
With regard to the abovementioned case and pursuant to Article 60(3) of the General Data Protection
Regulation (GDPR), the National Data Protection Commission (Luxemburg Data Protection Authority,
hereafter: NL LUX) has issued the following draft decision:
Summary of the Case
1. In the framework of the European cooperation, as provided for in Chapter VII of Regulation
(EU) 2016/679 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive 95/46/EC (General Data
Protection Regulation or GDPR), the Supervisory Authority of Bavaria (Germany) submitted to
the National Data Protection Commission (hereinafter: “the CNPD”) the complaint of
(national reference of the concerned authority: LDA-1085.3.3068/21-I) via IMI in accordance
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
_______________________________________________________________________________________________________
with Article 61 procedure - 320241.
2. The complaint was lodged against the controller , who
has its main establishment in Luxembourg. Under Article 56 GDPR, the CNPD is therefore com-
petent to act as the lead supervisory authority.
3. The original IMI claim stated the following:
“The complainant states that has passed on its name and address as a return address
to another customer.”
4. In essence, the complainant asks the CNPD to check on the lawfulness of the processing, in
particular by investigating on the reasons why he received a return parcel from an
customer, addressed to him at his postal address, while he is not an seller.
5. The complaint is therefore mainly based on Articles 5 and 6 GDPR.
6. On the basis of this complaint and in accordance with Article 57(1)(f) GDPR, the CNPD re-
quested to take a position on the facts reported by the complainant and in particular
to provide a detailed description of the issue relating to the processing of the complainant’s
data, and in particular with regard to the reasons why he received a return parcel from an
customer, addressed to him at his postal address, while he is not an seller.
7. The CNPD received the requested information within the deadlines set
In law
1. Applicable legal provisions
8. Article 77 GDPR provides that “without prejudice to any other administrative or judicial rem-
edy, every data subject shall have the right to lodge a complaint with a supervisory authority,
(...) if the data subject considers that the processing of personal data relating to him or her in-
fringes this Regulation.”
9. Pursuant to Article 5 (1) (a) (f) GDPR, personal data shall be “processed lawfully, fairly and in a
transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)”.
Article 6 (1) GDPR specifies the conditions for the lawfulness of processing.
10. Also, article 5(1) (f) stipulates that “personal data shall be […] processed in a manner that en-
sures appropriate security of the personal data, including protection against unauthorised or
unlawful processing and against accidental loss, destruction or damage, using appropriate
technical or organisational measures (‘integrity and confidentiality’)”.
11. Article 56(1) GDPR provides that “(…) the supervisory authority of the main establishment or of
the single establishment of the controller or processor shall be competent to act as lead su-
pervisory authority for the cross-border processing carried out by that controller or processor
in accordance with the procedure provided in Article 60”;
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
_______________________________________________________________________________________________________
12. According to Article 60(1) GDPR, "The lead supervisory authority shall cooperate with the other
supervisory authorities concerned in accordance with this Article in an endeavour to reach on-
sensus. The lead supervisory authority and the supervisory authorities concerned shall ex-
change all relevant information with each other”;
13. According to Article 60(3) GDPR, "The lead supervisory authority shall, without delay, com-
municate the relevant information on the matter to the other supervisory authorities con-
cerned. It shall without delay submit a draft decision to the other supervisory authorities con-
cerned for their opinion and take due account of their views”;
2. In the present case
14. Following the intervention of the Luxembourg supervisory authority, the controller confirmed
that:
• The order for which the complainant’s name and address seem to have been erroneously
provided as a return address, was an order;
• was therefore not the controller for the address data used for the return;
• Indeed, the respective seller acts as an independent controller, responsible for the personal
data entrusted to him or her. The seller is directly accountable to customers and to the
competent data protection authority for how they use the customer data;
• did not transfer the complainant’s address details to the seller for the return and
there was no breach on end;
• The return form is located in the respective seller account in the seller central tool, a
self-service tool for sellers on the . The seller can choose to insert a
return address in the return form in the seller central tool;
• The seller can, at any time, change or remove the information. The seller can choose that this
return form is provided as a return label for the package to the seller’s customers who wish
to return a purchase;
• The seller can also choose to prepare the return form individually each time a customer
requests a return label;
• Customers who wish to return a product log into their customer account and communicate
to the seller that they wish to return the item;
• The seller then provides the return label, which can be the return label as saved in the return
form in the seller central tool, or an individually prepared return label with a return address
different form the one saved in the return form in the seller central tool;
Thus, is not involved in the seller’s preparation of return labels and
does not control the information a seller inserts in the return form in the seller central tool.
• This means that is not the controller for the personal information sellers insert in the
return form in the account in the seller central tool and sellers are responsible for maintain-
ning accurate information at all times.
• Finally, also provided the CNPD with the identity of the Seller and emphasized that it
is standard procedure to follow up on privacy violations by marketplace sellers, in order to
protect the customers and their personal data. In this case, the seller was prohibited to sell
On German website previous to the complaint, for violation of terms (non-
privacy related issues). informed the CNPD that they therefore could not take any
additional steps against the seller.
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
_______________________________________________________________________________________________________
3. Outcome of the case
15. The CNPD, in a plenary session, therefore did not identify, on the basis of the information
provided, any infringement by the controller of the obligations set out in Regulation (EU)
2016/679 (GDPR). In particular, the CNPD is of the opinion that could not exercise any
control on the personal data that is inputted as return address by third party seller in
its systems. On the other hand, the CNPD believes that can always take measures
ex post if it detects that a particular third party seller used the personal data of a data subject in
a noncompliant way. In the present case, however, the third party seller had already been
dismissed by , so that was unable to take further corrective measures.
16. The CNPD sitting in plenary session therefore considers that, upon completion of the handling of
the present complaint and in the light of the foregoing, it seems appropriate to reject the
complaint as per Article 60(8) GDPR.
17. The CNPD then consulted the supervisory authority of Bavaria (Germany), pursuant to Article
60(1), whether it agreed to close the case. The Supervisory Authority of Bavaria (Germany) has
responded affirmatively, confirming also that they saw no possible infringement by the controller
in this case. Thus, the CNPD has concluded that no further action was necessary and that the
cross-border complaint could be closed by rejection.
As the concerned supervisory authorities (including BayLDA) did not object to this draft decision, the
BayLDA hereby adopts this draft decision as final decision in accordance with Article 60(8) of the GDPR.
According to marginal no. 239 of Guidelines 02/2022 we kindly ask the CNPD to inform the controller
about the decision on our behalf.
Ansbach, 05.08.2024