Datatilsynet
Your reference
Our reference
24/01126-8
Date
02.01.2025
## Final decision - closure of case
Datatilsynet refers to your complaint dated 6 March 2024 regarding unauthorized access to personal data about Freetrailer Group A/S users and lack of appropriate technical measures.
### Decision
Datatilsynet rejects your complaint.
### Background
We informed you on 17 April 2024 that this is a so-called cross-border case. The case is cross-border because Freetrailer Group A/S is established in more than one EEA country and the processing in question takes place in the context of the activities of such establishments. To ensure uniform application of the GDPR in the EEA, data protection authorities across the EEA must cooperate in the handling of cross-border cases.
The Danish Data Protection Authority has acted as lead supervisory authority in the handling of your complaint. We, and four other supervisory authorities, have been involved as concerned supervisory authorities.
### Reasoning for our decision
The Danish supervisory authority has investigated the subject matter of your complaint to the extent appropriate in accordance with Article 57(1)(f) GDPR and, based on such investigation, they have found that your claims were correct, but that you were the only person that accessed the data and that Freetrailer adopted technical measures to avoid this from happening again. The Danish supervisory authority has therefore concluded that they have investigate your complaint to the extent appropriate and that the case should be closed. All concerned supervisory authorities, including us, agree with such conclusion.
Please find below information from the Danish supervisory authority. This information explains how your complaint has been handled and the reasons as to why your complaint should be rejected. As your complaint is to be rejected, the supervisory authority that received your
Postal address:
P.O. Box 458 Sentrum
N-0105 OSLO
Office address:
Trelastgata 3
N-0191 OSLO
Phone:
+47 22 39 69 00
Ent.reg:
974 761 467
Home page:
www.datatilsynet.no/en/
complaint – in this case us – is the one which will adopt the final decision pursuant to Article 60(8) GDPR.
*The Danish Data Protection Agency (hereinafter the Danish DPA) hereby returns to the case where, on 12 th of March 2024, you made a complaint about Freetrailer Group A/S (hereinafter Freetrailer) to the Danish DPA. In addition, the Danish DPA also received your complaint from the supervisory authority in Norway, which – as part of the cooperation mechanism in cross-border cases – introduced the case to the other EU supervisory authorities on the 8 th of May 2024. The supervisory authority in Denmark, Datatilsynet, has dealt with the case as a lead (competent) supervisory authority, including in cooperation with the other supervisory authorities. This is due to the fact, that Freetrailer’s Central Administration, that decides on the purpose and means, is located in Denmark.*
*Overall, it appears from your complaint that unauthorized persons have the opportunity to access the personal data of Freetrailer’s customers via Freetrailer’s booking-service, which, according to you means, that Freetrailer has not put in place appropriate technical measures to protect the customers’ personal data. In the complaint, you have also stated that you are a user of Freetrailer, and therefore the Danish DPA has assessed that you are entitled to complaint pursuant to article 77 of the General Data Protection Regulation.*
*On the basis of your complaint, the Danish DPA asked Freetrailer for a statement on the matter by letter of 17th of May 2024, including questions about the extent to which Freetrailer agrees with the matters you had described in your complaint, and whether it had been possible for unauthorised persons to gain access to third-party personal data via their booking-services. At the same time, the Danish DPA also sent a copy of the letter to you.*
*Freetrailer replied to the Danish DPA’s hearing by letter of 10 th of June 2024, to which Freetrailer also had attached the written correspondence, that Freetrailer has had with you via e-mail in March 2024.*
# ***The Danish DPA does not take any further action based on your complaint***
*The Danish DPA has now decided to discontinue its investigation, and the case is therefore closed with this letter. The Danish DPA has hereby decided to reject your complaint, cf. Article 60(8) of the General Data Protection Regulation.*
# ***Presentation of facts***
*Freetrailer has confirmed that the matters stated in your complaint regarding the inadvertent possibility of access to customers’ personal data were correct. After further investigation by Freetrailer, where they compared your IP address with the one that had accessed the personal data, they were able to conclude that you were the only person who has had access to the personal data via API-Audit.*
2
*Based on your inquiry, Freetrailer has taken some technical measures to avoid similar incidents in the future, including for instance closing public access to Freetrailer’s API audit domain, conducting a full review of other API’s to ensure that nothing else is publicly exposed, and removing authentication on the client side.*
### The reasons for the Danish DPA’s decision
*The Danish DPA has dealt with the case in accordance with Article 57(1)(f) of the General Data Protection Regulation.*
*It follows from the mentioned provision that the supervisory authority shall handle complaints lodged by a data subject and investigate, to the extent appropriate, the subject matter of the complaint. The decision of the Danish DPA to not initiate a further investigation into your case is based on an assessment made by the Danish DPA of what may potentially be achieved by initiating such an investigation, including to which degree this may specifically be of help to you, or whether such an investigation would be suitable in generally increasing the level of data protection.*
*The reason for the decision is that by continuing its investigation, the Danish DPA will not be able to help you achieve a better legal position, or otherwise be able to promote knowledge of data protection law rules and principles, as Freetrailer has already taken technical measures in such a way that it is not possible for unauthorized persons to gain access to customers’ personal data. The assessment also takes into account the use of resources that would be associated with such an investigation.*
### Closing remarks
*The Danish DPA considers this case closed, and will therefore take no further action in relation to your complaint.*
### Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII of the GDPR, and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant to Section 22(2) of the Norwegian Personal Data Act (*in Norwegian: personopplysningsloven*). This decision can nevertheless be challenged before Norwegian courts in accordance with Article 78(1) GDPR.
### Duty of Confidentiality
Parties to this matter have a duty of confidentiality under Section 13(b) of the Norwegian Public Administration Act regarding the information they receive about the complainant’s identity, personal matters and other identifying information, and such information can only be used to the extent necessary to safeguard their interests in this case. Any breach of this duty of confidentiality can be punished pursuant to Section 209 of the Norwegian Penal Code.
In light of the above, we have now closed our case on this matter.
Tobias Judin Head of Section
Selma Kjellemo juridisk rådgiver
3
*This letter has electronic approval and is therefore not signed*
4