Unofficial translation SPECIAL PROTECTION AND TRANSPARENCY OF THE MEMBER STATE
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Indication made: 07.03.2025
The access restriction applies until: 07.03.2100
for p 2 until entry into force of the Decision
Base: Section 35(1)(2), Section 35(1)(12) of the PIA
All SA’s Our 07.03.2025 No. 2.1.-1/24/168-347-27
ARTICLE 60 FINAL ADOPTED DECISION
Reprimand and termination of the proceedings
Circumstances
On 21 December 2023 and 8 January 2024, (the Complainant) lodged a complaint
with the Hungarian Data Protection Authority (the Hungarian DPA) under Article 77(1) of the
General Data Protection Regulation1 (GDPR) against ( , the
Controller). The Hungarian DPA forwarded the complaint to the Estonian Data Protection
Inspectorate (DPI) via the European Commission’s Internal Market Information System (IMI) on
1 February 2024. Since the main establishment of the Controller is in Estonia, the Estonian DPI
agreed to be the lead supervisory authority in the case on the basis of Article 56(1) GDPR.
According to the complaint, on 13 June 2023, the Complainant submitted a request for access to
personal data by e-mail to ( ), requesting information on the processing
of data relating to the assessment of passengers by drivers. In its replies of 13 June 2023,
referred to points 4.3 and 4.5 of the ‘Privacy Notice for Hungarian passengers’ as
information on data processing related to the assessment of passengers. The Complainant took the
view that the information contained therein was not sufficiently detailed and, on 30 June 2023,
requested further information on the data processing. More specifically, the Complainant requested
that the following questions be answered:
1) Under what conditions and according to what rules the driver assesses the passenger
(number of points/stars, consequences, etc.). How does the process work? For example,
estimating recalcitrant or non-paying passengers (or, conversely, a clean, punctual paying
passenger), number of points, consequences, identification of a specific person before the
next trips, etc.?
2) According to which data processing rules are such data processed and for what purpose are
they used (exact purpose of the processing, legal basis, retention period, amount of data
processed, etc.)?
On 20 July 2023, informed the Complainant that was the controller of
the data processing relating to the assessment of passengers. also indicated that the
processing is based on the legitimate interest of the Controller and that the personal data related to
the evaluation will be processed for three years. The reply referred to ’s privacy policy
in English and the complainant was directed to by e-mail at for
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation).
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / registry code 70004235
further questions. In response, on 20 July 2023, the Complainant expressed his dissatisfaction with
having to contact the Controller himself and start an interview in English and asked
to send in Hungarian the data protection conditions and the analysis of legitimate interest in data
processing in relation to the assessment of passengers. In addition, the Complainant also requested
information on the rules and methods of the rating system. In response to that request, on 26 July
2023, informed the Complainant that it had forwarded its request to ,
but that no further substantive developments had taken place on the basis of the exchange of emails
annexed to the complaint and that the Complainant had not received any further substantive answer
to the questions raised in its request.
Proceedings of the Estonian DPI
The Estonian DPI initiated a supervisory procedure on the basis of clause 56 (3) 8) of the Personal
Data Protection Act and sent a proposal to the Controller on 13 February 2024 for better
compliance with the requirements for the protection of personal data. The proposal asked the
Controller to send the Complainant, by e-mail, the information required under Article 15 GDPR
in relation to the assessment of passengers in Hungarian and to send a copy of the reply to the
Estonian DPI. In addition, the Estonian DPI specified the questions to which the Complainant
wished to have answers. The deadline for implementing the proposal was 28 February 2024.
The Controller replied to the Estonian DPI on 28 February 2024, agreeing with the proposal and
explaining how they intend to address it. The main obstacle to answering the Complainant’s
questions was another supervisory procedure initiated by the Estonian DPI in connection with the
assessment of the legal basis for the assessment of passengers. In the above-mentioned procedure,
the Controller waited for the necessary feedback from the Estonian DPI in order to make some
changes to the analysis of legitimate interest and to translate the document into Hungarian.
Therefore, the Controller requested an extension of the deadline for the submission of the proposal.
In particular, the Controller indicated that it would be reasonable for them to answer the questions
asked by the Hungarian data subject as soon as they receive feedback from the Estonian DPI on
the analysis of legitimate interest in the passenger assessment. On 11 March 2024, the Estonian
DPI submitted a repetitive proposal to the Controller and set a new deadline of 18 March 2024.
The Controller requested an extension of the deadline for the proposal until 05.04.2024 in the
context of the parallel proceedings. The Estonian DPI extended the deadline for responding to the
proposal until 05.04.2024. On 5 April 2024, the Controller sent the Estonian DPI a confirmation
letter concerning the execution of the proposal (i.e. that the Complainant’s request had been
answered).
Given that the Estonian DPI is conducting parallel proceedings2 against the Controller concerning
data processing related to the assessment of passengers (including the lawfulness of data
processing, prior notification of the data subject), the present proceedings concern the failure to
respond to a request submitted on the basis of Article 15 GDPR. Therefore, the present procedure
does not deal with the lawfulness of data processing related to the assessment of passengers, nor
does it cover compliance with the obligation to provide prior information regarding data
processing related to the assessment of passengers. However, in the context of the present
proceedings, the Estonian DPI asked the Controller to provide further clarifications concerning the
passenger assessment function in Hungary, since, following the inclusion of the draft decision by
the Estonian DPI in IMI, the Hungarian DPA objected to the processing of the passenger
assessment and to the assessment of the lawfulness of the prior notification of the data subject.
Clarifications by the controller
In the parallel proceedings and also in the present proceedings, the Controller has confirmed to the
Estonian DPI that the passenger assessment function has been switched off in the European Union,
2
Supervisory procedure No 2.2.-1/23/1109-3956 of the Data Protection Inspectorate; In IMI, Case Register No
359323.
2 (6)
including Hungary, on 31 October 2023 and that the Controller has not collected any new personal
data relating to the assessment of passengers since that date.
As of 02.12.2024, the passenger assessment function has not been reactivated in Hungary. The
Controller confirmed that before restarting the passenger assessment function, will
first ensure that all necessary requirements are met. Information about the processing of personal
data is transparently reflected in the privacy notice for passenger (available in Hungarian at
). This Privacy Notice sets out in
a clear and detailed manner the personal data processing practices and any updates or changes. If
the Passenger Rating feature is restarted, users will be informed through this Privacy Notice.
In parallel supervisory proceedings, the Controller has assured the Estonian DPI that, as of 28
February 2024, deleted all assessments and comments collected by the Controller
regarding taxi service passengers, which have been collected at least three years ago, and the
corresponding deletion to comply with the three-year retention period will take place automatically
as of 28 February 2024 on an ongoing basis. In the present proceedings, the Controller emphasised
that such a deletion policy has been unequivocally implemented in all EU Member States in which
operates, including Hungary.
The Controller explained that a retention period of 3 years is justified to investigate fraud and
safety incidents, resolve disputes and assist passengers in providing clarifications on passenger
assessments and access requests. The retention of data for a period of 3 years is in the legitimate
interest of the Controller (Article 6(1)(f) GDPR). With regard to the three-year retention period,
the Controller has provided the Estonian DPI with explanations in the analysis of legitimate
interest submitted in the framework of surveillance procedure No 2.2.-1/23/1109-3956.
In addition, the Controller clarified that the exclusion status of the driver and the passenger will
be maintained until the passenger or driver deletes their account (whichever comes first).
Maintaining the exclusion status at such a length is justified by the driver’s wish not to be
connected to a specific passenger anymore. As long as the driver and passenger both use the
platform, cannot delete the exclusion status without endangering the driver. The danger lies
in reconnecting with a specific passenger. Maintaining the exclusion status for such a period is
consistent with the legitimate interest of and its drivers in ensuring security under Article
6(1)(f) of the GDPR, as explained in the analysis of the legitimate interest submitted to the
Estonian DPI in the context of supervisory procedure No 2.2.-1/23/1109-3956.
Passengers are informed about the data retention criteria (including the 3-year retention period) in
the privacy notice applicable to passengers (available in Hungarian at
).
The controller confirmed that, on 5 April 2024, the Complainant had been informed of the
information required under Article 15 of the GDPR and attached a copy of the letter, together with
the relevant annexes:
1) reply to the Complainant (original reply in Hungarian and Estonian translation);
2) Annex 1 to the reply to the Complainant: an extract from the passenger privacy policy on
data processing related to the assessment of passengers (Hungarian and Estonian
translation);
3) Annex 2 to the reply to the Complainant: a legitimate interest assessment of the data
processing concerning the assessment of passengers (Hungarian and Estonian translation).
The position of the Estonian DPI
Pursuant to Article 12(1) GDPR, the controller shall take appropriate measures to provide the
information referred to in Articles 13 and 14 and to inform the data subject of the processing
pursuant to Articles 1522 and 34 in a concise, clear, intelligible and easily accessible form, using
3 (6)
clear and plain language.
Article 15(1) GDPR enshrines the data subject’s right of access (including information on the
processing of his or her personal data). According to Recital 63 GDPR, the data subject should
have the right of access to personal data which have been collected concerning him or her and to
exercise that right easily and at reasonable intervals in order to be aware of and verify the
lawfulness of the processing. Every data subject should therefore have the right to know and obtain
communication in particular of the purposes for which the personal data are processed, where
possible, the period for which the personal data are processed, the recipients of the personal data,
the logic involved in automatic processing of personal data and the possible consequences of such
processing, at least where the processing is based on profiling.
Thus, under Articles 12(1) and 15(1) GDPR, the controller must provide the data subject with the
information requested by the data subject (requirement for accuracy) and the information must be
provided in an easily intelligible manner, without excessive effort on the part of the data subject
to understand that information (requirement for intelligibility). The requirement of intelligibility
also affects the language used for the exchange of information. Although the GDPR does not
explicitly regulate the use of languages, it is clear that the intelligibility of information is directly
linked to the ability of the user to understand the language used. However, it should be considered
that the controller is obliged to inform the data subjects to whom it offers its goods or services or
whose behaviour it monitors in their own language.3 Therefore, if the service is targeted at
residents of a specific country and the service itself is provided in the language of the country of
official residence, the controller must be prepared to provide data protection information in the
official national language4 of that country (in this case Hungarian residents). However, in the
present case, the data subject did not have to communicate with the controller in English –
forwarded the data subject’s request to the Controller and partially replied to the data
subject, and the Controller replied to the data subject’s request in Hungarian (albeit only during
the supervisory procedure).
Pursuant to Article 12(2) GDPR, the controller shall facilitate the exercise of the rights of the data
subject under Article 1522 GDPR. The controller should facilitate the exercise of the above rights
by the data subject. Thus, the controller could have clarified the data subject’s request by indicating
that the documents requested by the complainant were under review at the time of receipt of the
request. In its Guideline 01/2022, the EDPB has stressed that the requirement to specify must not
be intended to restrict the response to a request for access and must not be used to conceal data or
information about the processing concerning the data subject. In any event, the controller should
always be able to demonstrate that the manner in which the request is dealt with is intended to
ensure the widest possible exercise of the right of access and is compatible with its duty to facilitate
the exercise of the rights of the data subject.5
Pursuant to Article 12(3) GDPR, the controller is obliged to respond to requests from the data
subject without undue delay and at the latest within one month of receipt of the request. That
period may be extended by two months where necessary, taking into account the complexity and
number of the request. The controller shall inform the data subject of any such extension and of
the reasons for the delay within one month of receipt of the request.
3
General Data Protection Regulation. Article-by-Article Commentary, 14 December 2023, Art. 12, p. 11, pp. 439-
440.
4
European Data Protection Board. Guidelines 03/2022 on deceptive design patterns in social media platform
interfaces: how to recognise and avoid them, 14 February 2023, p. 75, p. 29. -
https://www.edpb.europa.eu/system/files/2023-02/edpb_03-
2022_guidelines_on_deceptive_design_patterns_in_social_media_platform_interfaces_v2_en_0.pdf
5
European Data Protection Board. Guidelines 01/2022 on data subject rights - Right of access, ver 2.1, 28 March
2023, p. 17. –
https://www.edpb.europa.eu/system/files/2024-04/edpb_guidelines_202201_data_subject_rights_access_v2_et.pdf
4 (6)
According to the complaint, on 13 June 2023, the Complainant submitted a request for access to
personal data to by e-mail (more specifically, to obtain information on the processing
of personal data). Although partially replied to the Complainant (i.e. explained that
the processing is based on the legitimate interest of the Controller and the personal data related to
the assessment will be processed for three years) and forwarded the Complainant’s request to the
Controller, the Complainant did not receive an exhaustive response from the Controller to its
request.
Given that the Complainant received a response to its request only after the intervention of the
supervisory authority on 5 April 2024, this suggests that the processes of the Controller in handling
the data subject’s request did not ensure compliance with the data protection regulation and did
not work. In doing so, the controller infringed Articles 12(3) and 15(1) of the GDPR.
In the event of a breach of the GDPR, the Estonian Data Protection Inspectorate has various
corrective powers, including a reprimand, an injunction, a fine (Article 58(2)(a)(j) of the GDPR).
In particular, the measure should be appropriate, necessary and proportionate, taking into account
the circumstances of each individual case.6 In the case of a minor offence, the Estonian Data
Protection Inspectorate may, in accordance with Article 58(2)(b) of the GDPR, issue a reprimand
instead of a fine, as stated in recital 148 GDPR. The aggravating and attenuating circumstances of
the case must be taken into account.
The Estonian DPI takes into account that:
1. The monitoring procedure shall be based on an individual complaint by one of the data
subjects.
2. The Controller has confirmed that the data subject's request has not been answered in
accordance with 's processes and its customer support team has been instructed to do
so in order to prevent such errors in the future.
3. According to the Estonian DPI, the Complainant received answers to the questions set out
in the complaint (including in Hungarian and not in English).
4. The Controller cooperated with the Estonian DPI.
Since the Controller has infringed Articles 12(3) and 15(1) of the GDPR, the Estonian Data
Protection Inspectorate, relying on Article 58(2)(b) of the GDPR, issues a reprimand to
and draws attention to the following:
1. The controller shall take appropriate measures to inform the data subject of the processing
of personal data in accordance with Article 15 of the GDPR in a concise, transparent,
intelligible and easily accessible form, using clear and plain language (Article 12(1)
GDPR).
2. The controller shall provide the data subject with a report on the action taken on request
pursuant to Articles 15 to 22 without undue delay and at the latest within one month of
receipt of the request. That period may be extended by two months where necessary, taking
into account the complexity and number of requests. The controller shall inform the data
subject of such extension and of the reasons for the delay within one month of receipt of
the request (Article 12(3) GDPR).
Based on the above, the Estonian Data Protection Inspectorate shall terminate the present
supervision proceedings.
This reprimand and notice of termination can be challenged within 30 days by submitting either:
A challenge to the Director General of the Estonian Data Protection Inspectorate pursuant
to the Administrative Procedure Act7, or
6
Recital 129 of the GDPR.
7
https://www.riigiteataja.ee/en/eli/527032019002/consolide
5 (6)
An appeal to the administrative court under the Code of Administrative Court Procedure8
(in this case, the challenge in the same case can no longer be reviewed).
Yours sincerely,
Lawyer
By delegation of the Director-General
8
https://www.riigiteataja.ee/en/eli/512122019007/consolide
6 (6)