Unofficial translation PROTECTION OF PRIVATE LIFE AND TRANSPARENCY OF THE STATE
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Notation made: 16.05.2025
The access restriction shall be valid until: 16.05.2100,
for p 2 until entry into force of the Decision
Legal ground: Section 35(1)(2), Section 35(1)(12) of the PIA
All SA’s Our 16.05.2025 No. 2.1-12/24/1032-2402-6
ARTICLE 60 FINAL ADOPTED DECISION
Termination of the proceedings
On 06.09.2024, the Finnish Data Protection Authority (the Finnish DPA) forwarded to the Estonian
Data Protection Inspectorate (the Estonian DPI) ’s (the Complainant) complaint
against regarding access right.
The Estonian DPI agreed to be the lead supervisory authority in the case and commenced a
supervisory procedure1 based on the complaint. The Estonian DPI has previously been informed
that, as of 1 January 2022, (hereinafter the Controller, ) will continue to
be the controller in all cases related to the platform instead of .
is also indicated as the data controller in ’s privacy policy. Since
is also an Estonian company whose management board is in Estonia and all
decisions concerning data processing are taken in Estonia, the Estonian DPI is the leading
supervisory authority in the matter.
Facts of the complaint
According to the complaint, the Complainant received a direct marketing offer from at his
email address. Since the Complainant was not a customer of , he wished to know how
had obtained his contact details and contacted the Controller on 6 September 2023. In its
application, the Complainant requested the following information under the GDPR:
˗ Source of my personal data;
˗ What my data is needed for;
˗ How long is my data needed;
˗ Has my personal data been disclosed - if yes, to whom;
˗ Has my personal data been transferred outside the EU? If yes, how has the data been
protected;
˗ Does the processing of my data involve automated decision-making – if the answer is yes,
what does it (automated decision-making) mean in this case;
˗ How can I exercise my data subject rights?
On 7 September 2023, the Controller replied to the Complainant, recommending to contact
via the app or to confirm his e-mail address. The Complainant does not have a application
and does not wish to download it. The Complainant informed the Controller that he did not have
a application. On 7 September 2023, the Controller replied to the Complainant that it was not
possible to transfer the requested data without identifying the Complainant. On the same day, the
1
The Estonian DPI commenced proceedings on the basis of Section 56(1) and (3)(8) of the Personal Data Protection
Act. Legal basis for requesting clarifications: Sections 57-58 of the Personal Data Protection Act, Section 30(1) and
(3) of the Law Enforcement Act, Article 58(1)(a), (e) and (f) of the General Data Protection Regulation.
Tatari 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registry code 7000423
Complainant asked the Controller which identification methods would be accepted. No further
correspondence was annexed to the complaint.
After lodging the complaint, the Complainant informed the supervisory authority on 9 September
2024 that had replied to him and granted the Complainant access to the personal data, but that
the reply did not specify the source of the data or when the data had been received. No further
correspondence between the Complainant and the Controller was added to the details of the
complaint.
Clarifications by the Controller
The Controller explained that all the requested information had been sent to the Complainant on 1
December 2023, which included:
1) A copy of all personal data of the Complainant’s user profile;
2) A copy of the emails exchanged between the customer support team and the
Complainant;
3) An explanatory letter containing information on:
- the source, storage and collection of the Complainant’s personal data;
- List of third parties to whom the personal data have been disclosed;
- Information on international transfers and safeguards for limited transfers;
- Information on automated decision-making;
- Information on the possibilities of exercising the rights of the Complainant as a data
subject.
The Controller forwarded to the Estonian DPI the correspondence exchanged with the
Complainant and the reply to the access request, which was sent to the Complainant on 1 December
2023. The Controller also explained that the Complainant had not submitted any further requests
to since 1 December 2023.
As regards the authentication solutions in place, the Controller explained that when a data subject
submits a request to to exercise his or her rights as a data subject (hereinafter DSRR) by e-
mail, which is not linked to any existing account, checks the person as follows:
1) Redirects the data subject to submit his or her DSRR request via the application - the
data subject must be logged in to the account in order to submit the request via the
application; or
2) Invites the data subject to contact from the email address associated with his account,
either by contacting the customer support team, the privacy team or via the online form:
The Controller explained that the Complainant submitted his request to on 6 September 2023
at . In its database, the customer support team identified the user
profile associated with that email address and verified that it corresponded to the email address in
the Complainant’s account. According to the internal rules, the customer support team should
have proceeded with the e-mail address verification process and forwarded the DSRR’s reply to
the Complainant’s e-mail. As a result of a human error, the customer support team asked the
Complainant to contact it via the application, after which the Complainant explained that he
did not have the application. The customer support team corrected the error and proceeded
with the verification process of the Complainant’s email address by sending a verification message
to the Complainant’s email address. The Complainant confirmed his e-mail address on 8
September 2023. On 1 December 2023, the customer support team sent DSRR’s reply to the
Complainant’s email address, together with all the information requested by the Complainant.
The Controller further stated that, on 22 November 2024, again sent to the Complainant a the
DSRR’s reply, to which the time of collection of the personal data was added.
2 (4)
The position of the Estonian Data Protection Inspectorate
1. Under Article 15(1) of the General Data Protection Regulation (GDPR), the data subject
has the right to obtain from the controller confirmation as to whether his or her personal data are
being processed and, if so, he or she has the right to access his or her personal data and the
information listed in Article 15(1) of the GDPR. If the controller receives the data subject's request
for information and/or a copy of the personal data being processed, the controller must, pursuant
to Article 12(3) GDPR, respond to the data subject's request without undue delay, but not later than
within one month. That period may be extended by two months where necessary, taking into
account the complexity and number of the request. The controller shall inform the data subject of
any such extension and of the reasons for the delay within one month of receipt of the request.
2. On 6 September 2023, the Complainant contacted by e-mail and asked questions
concerning the processing of his personal data. There was an error in communication between the
Complainant and the Controller in the process of identifying him on 7 September 2023. When
specifying the complaint on 9 September 2024, the Complainant indicated to the supervisory
authority that it had received access to its personal data from the Controller, but that the reply
lacked information on the source of the data and when the Controller received the data. The
Complainant assumed that had obtained the data when the company operated under a different
name. However, the Complainant did not forward the additional correspondence to the Estonian
DPI and did not specify when it received the reply from .
3. The Controller assured the Estonian DPI that there was an error in communication with the
Complainant due to a human error in the identification process, but the customer support team had
corrected the error. It is apparent from the correspondence sent to the Estonian DPI that the error
was corrected immediately on the same day and that the verification process was resumed by
sending a verification message to the Complainant’s email address. The Complainant confirmed
his e-mail address on 8 September 2023. On 13 October 2023, the Controller informed the
Complainant that it would extend the deadline for adjudicating the request by two months until 7
December 2023 due to the complexity (technical difficulties in obtaining the data and the need for
expert work to obtain the information and prepare it for transmission to the Complainant in a
comprehensible form). The Complainant obtained access to the data on 1 December 2023.
4. Although the Complainant stated that he had received a reply to its request but that the
source of the data had not been indicated, the Estonian DPI took the view that the reply sent to the
Complainant by on 1 December 2023 contained information on the various sources of the
data. For example, the Controller has indicated that it received the contact details from the
Complainant himself. The Complainant himself assumes this in his complaint, stating that he
suspects that the contact details come from a single use of the service in 2016. The Estonian
DPI explains that changed its name in 2019 and became the new brand.
5. The Complainant also stated, that it had not received a reply from as to when the
Controller had received the data. However, in his initial request, the complainant did not ask the
controller when the controller received his or her data. ’s reply to the Complainant indicates
the last time the Complainant logged in to the application. As far as the Estonian DPI is aware, the
Complainant has not sent any further questions to in response to his DSRR’s reply.
6. The Controller explained to the Estonian DPI that, on 22 November 2024, it had again sent
the Complainant a reply to the access request, accompanied by the time of collection of the
personal data. The Estonian DPI asked the Finnish DPA to contact the Complainant and ask for
confirmation that his access request had been answered. The Finnish DPA informed the Estonian
DPI that it had not received a reply from the Complainant.
7. In the light of the foregoing, the Estonian DPI takes the view that the Complainant received
a response from the Controller to his access request and that his rights under Article 15 of the
3 (4)
GDPR were not infringed by the Controller. Based on the above, the Estonian DPI terminates the
supervisory procedure.
8. However, the DPI draws the attention of the Controller to the fact that, under certain
conditions, the controller may, if necessary, extend the period for responding to a request for access
by an additional two months, taking into account the complexity and number of requests. 2 The
EDPB has provided examples that when information is difficult to find or when further work is
needed to make the information intelligible, it can be considered complex. However, the EDPB
has underlined that this option is an exception to the general rule and should not be overused. The
fact that a large company receives a large number of applications cannot be a reason to extend the
deadline for replying to an application. The controller, especially when processing large amounts
of data, should have processes and mechanisms in place to be able to handle requests under normal
circumstances within 30 days.3
This notice of termination of the supervision proceedings can be challenged within 30 days by
submitting an appeal to the administrative court under the Code of Administrative Court
Procedure4.
Respectfully,
lawyer
authorized by the Director-General
2
Article 12(3) GDPR.
3
European Data Protection Board. Guidelines 01/2022 on data subject rights – Right of access, ver 2.1, adopted on
28 March 2023, paras 162-164, pp. 51-52.
4
https://www.riigiteataja.ee/en/eli/ee/512122019007/consolide/current
4 (4)