BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
Our reference: LDA-1085.1-919/20-F
Reference Sweden: IMY-2023-15273
IMI Art. 56: 185306
IMI draft decision: 758623
Controller: publ)
On the basis of the draft decision of the Swedish Integritetsskyddsmyndigheten (SE DPA) No. 758623, the
Data Protection Authority of Bavaria for the Private Sector (BayLDA) pursuant to Article 60(8) of the GDPR
issues the following
Final Decision:
The complaint is rejected.
Justification:
The complaint was received by the BayLDA on 27 January 2020 and was forwarded via IMI to the SE DPA
as the lead data protection supervisory authority for the controller.
In April 2025 the SE DPA submitted the draft decision no. 758623 to the concerned supervisory authorities
with the following contents:
Decision of the Data Protection Authority
The Swedish Authority for Privacy Protection (IMY) finds that the investigation does not show any infringements of
Article 6(1) or Article 15 of the General Data Protection Regulation (GDPR) 1 in the manner alleged in the complaint.
The case is closed.
Presentation of the supervisory case
Proceedings
IMY has initiated supervision of ( or the company) due to a complaint. The complaint has
been submitted to IMY, as the lead supervisory authority for the company's activities under Article 56 of the General
Data Protection Regulation. The handover has been made from the supervisory authority of the country where the
complainant has lodged their complaint (Germany). The transfer has taken place in accordance with the provisions
of the regulation on cooperation in cross-border processing.
The investigation in this case has been carried out through written procedure. In view of the cross-border nature of
the processing, IMY has made use of the cooperation and consistency mechanisms provided for in Chapter VII of
1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation).
the GDPR. The supervisory authorities concerned have been the data protection authorities of Germany, Ireland,
Norway, Estonia, Italy, Finland, Denmark, France and Spain.
IMY's investigation has focused firstly on whether disclosed the complainant's data to a debt collection
agency without a legal basis under Article 6 of the GDPR and secondly on whether the handled the com-
plainant's access request in breach of Article 15 of the GDPR.
IMY has communicated ’s response to the relevant national supervisory authority in the country where the
complainant lodged the complaint. The German Data Protection Authority has replied that the complainant has not
responded.
What the complainant has stated
The complainant states that she ordered goods from a company but never received the goods or, for that matter,
received an invoice or first reminder in connection with the order. Despite this, the complainant received a payment
claim from on 2 November 2019. The complainant contested the claim on 4 November 2019 and, in doing
so, informed that they could not transfer her personal data.
As the complainant did not receive any feedback from , she sent a reminder to them on 28 November 2019.
According to the complainant, transferred her data to debt collection despite her contestation.
The complainant has attached a letter from to the complaint. The letter is dated 3 December 2019 and in let-
ter, states that they has paused their claim against the complainant in order to investigate the matter.
states that their policy department will contact the complainant by e-mail and that she needs to respond to their
message, otherwise the claim will be reactivated. further explains that the complainant also has the option to
pause the claim herself in their application. In this case, will cancel the claim and contact the complainant and
the seller in order to investigate the issues raised by the complainant. also clarifies in the letter that they are
only responsible for their invoices. In case of problems with the seller's goods or their delivery, encourages
the complainant to contact the seller.
The complainant wrote to again on 6 December 2019, requesting that withdraw the debt from collec-
tion and that she be given access to her personal data. The complainant has stated that never replied. The
complainant sent a reminder to regarding her request for access on 30 December 2019. According to the
complainant, the reminder also remained unanswered by .
The complainant has attached copies of the letters to . IMY has requested proof of delivery through the Ger-
man Data Protection Authority, but the complainant has not responded.
What has stated
is the data controller for the processing in question.
The purchase in question
The information provided by the complainant is not correct. In connection with the order, the complainant provided
an e-mail address that had reason to believe was correct. has sent e-mails in connection with the or-
der, when the deadline for payment was approaching and when the due date of the invoice had passed.
has also sent a push notification to the mobile phone number provided by the complainant in connection
with the payment.
The claim was submitted for collection only after it had fallen due and the complainant had not made payment in
accordance with her contract with . Before handing over the debt for collection, made several attempts
to contact the complainant, as described above. The information provided by to the
debt collector has consisted of the complainant's contact and identification details, information on the goods pur-
chased and information on the use of 's services, i.e. information on the purchase and the debt.
From what can see, the complainant has made a return after the due date of the invoice. has subse-
quently withdrawn the case from the collection agency and the collection agency has ceased processing the com-
plainant's data. The complainant has since been reimbursed for the order and has written off the order
amount.
Legal basis for processing
has based the processing on a balancing of interests under Article 6(1)(f) of the GDPR. The purpose of the
processing has been to collect the debt by outsourcing to a third party, a debt collection company.
has assessed that they have a legitimate interest in collecting debts. According to , the processing was
necessary for the debt collection agency to be able to collect the debt, identify the debt and contact the complain-
ant. If the debt collection agency did not receive the information from , it would not be clear which debt was
involved or who the complainant was.
has designed their process in a way that balances the interests of the complainant against the interests of
. In their balancing of interests, has taken into account that the debt has passed the due date, that the
customer has not paid in accordance with the agreement, that has attempted to collect the debt on their
own, that the purpose of the processing was to collect the debt and that the processing ceased when the case was
withdrawn from the debt collection company. In light of this, has concluded that the complainant's interests
do not outweigh their interests in collecting the debt.
Handling of the complainant's request for access
has not received any request for access from the complainant.
Reasons for the decision
Applicable provisions etc.
Article 5 of the GDPR sets out principles for the processing of personal data, such as that the data must be pro-
cessed lawfully, fairly and in a transparent manner in relation to the data subject. It also states that the controller is
responsible for and must be able to demonstrate compliance with Article 5.
Article 24 of the GDPR states that it is the responsibility of the controller to implement appropriate technical and
organisational measures to ensure that processing is carried out in accordance with the regulation, taking into ac-
count the context and purposes of the processing and the risks of varying likelihood and severity for the rights and
freedoms of natural persons.
Article 57(1)(f) of the GDPR requires IMY to deal with complaints from data subjects who consider that their per-
sonal data are processed in a manner contrary to the GDPR. The provision further states that IMY shall, where ap-
propriate, investigate the substance of the complaint. The CJEU has stated that the supervisory authority shall inves-
tigate such complaints with due diligence.2
According to Article 6(1) of the GDPR, the controller must be able to support the processing of personal data on a
lawful basis in order for the processing to be authorised. The controller may process personal data on the basis of
Article 6(1)(f) of the GDPR if the controller (1) has a legitimate interest, (2) the processing of personal data is neces-
sary to fulfil the legitimate interest pursued and (3) the interests or fundamental rights and freedoms of the data
subject do not override the legitimate interest.3
2
See judgement of the Court of Justice of the European Union, Schrems II, case C-311/18, EU:C:2020:559,paragraph 109
3 See CJEU judgement TK, C-708/18, EU:C:2019:1064 , paragraph 40
According to Article 15 of the GDPR, the data subject shall have the right to obtain from the controller confirmation
as to whether or not personal data concerning them are being processed. If such data is being processed, the con-
troller must provide the complainant with additional information and a copy of the personal data processed by the
controller.
IMY's assessment
The first issue to be considered by IMY is whether disclosed the complainant's data to a debt collection
agency without a legal basis under Article 6 of the GDPR. The second issue for the IMY to consider is whether
has handled the complainant's request for access in breach of Article 15 of the GDPR.
Based on the complaint in the case, IMY has only examined ’s behaviour in the individual case and whether
the processing in question can be supported by a legal basis. The supervision does not cover whether 's per-
sonal data processing is otherwise compatible with the GDPR.
IMY's obligation to investigate
IMY has asked questions in relation to the complaint. The complainant has subsequently been given the op-
portunity to comment on 's answers to the questions. IMY has thus investigated the matter to the extent re-
quired by Article 57(1)(f) of the GDPR and Section 23 of the Swedish Administrative Procedure Act.
Legal basis for the processing
has stated that they transferred the complainant's personal data on the basis of a balancing of interests for
the purpose of collecting the debt with the help of a debt collection agency.
IMY does not question whether debt recovery can in itself constitute a legitimate interest, whether the transfer of
the data was necessary to fulfil the stated purpose or whether the interest of in being able to recover debts is
overriding. However, IMY considers that it is unclear how the purchase in question took place and when the transfer
of the complainant's personal data to debt collection actually took place.
The complainant's position is that she has ordered goods from a company, but never received the goods or, for that
matter, any invoice or reminder regarding the purchase. The company's position is that they sent an order confirma-
tion as well as an invoice and reminders regarding the purchase and that the complainant made a return after the
invoice fell due for payment.
The complainant has further stated that transferred her data to debt collection despite her written objection.
For their part, has stated that the claim was transferred only after it fell due for payment and the complainant
did not make payment in accordance with the agreement. In 's letter to the complainant dated 3 December
2019, stated that the complainant either needed to reply to the e-mail from their policy department in order
for the claim not to be reactivated, or that the complainant herself needed to pause the claim in their application in
order for it to be cancelled. It is not clear whether the complainant got back to 's policy department or
paused the claim in the application.
Finally, has stated that they have withdrawn the case from the collection agency, that the processing of the
complainant's data by the collection agency has ceased, that the debt has been written off by and that the
complainant has been reimbursed for the amount of the order. The complainant's position on the allegation is un-
known.
IMY has on two occasions given the complainant the opportunity to comment on 's replies, but the complain-
ant has not responded. In addition, has given brief answers to IMY's questions. IMY notes that cer-
tainly has an obligation under Article 5(2) and Article 24 of the GDPR to demonstrate compliance with the regula-
tion, but in light of the fact that the incident occurred in 2019, IMY considers it understandable if the company can-
not account for all the circumstances of the case. The fact that the incident took place in Germany also makes it dif-
ficult for IMY to investigate the case further.
IMY therefore concludes that the matter has been investigated to the extent appropriate in the circumstances and
that the investigation does not support that the company has processed the complainant's personal data in viola-
tion of Article 6 of the GDPR in the manner alleged in the complaint.
The handling of the complainant's request for access
IMY has received a copy of the complainant's letter containing her request for access. states that they never
received the request.
IMY has communicated ’s response to the complainant through the German DPA, requesting proof of delivery
of the complainant's access request letters dated 6 December 2019 and 30 December 2019 respectively. The Ger-
man DPA has informed that the complainant has not responded.
IMY has thereby investigated the matter to the extent required by Article 57(1)(f) of the GDPR and Section 23 of the
Swedish Administrative Procedure Act.
IMY finds that the investigation in the case does not show that has failed to comply with Article 15 of the
GDPR in the manner alleged in the complaint.
Overall assessment
Overall, IMY concludes that the investigation does not show that the company has failed to comply with the GDPR
in the manner alleged in the complaint.
The case should therefore be closed.
As the concerned supervisory authorities (including BayLDA) did not object to this draft decision, the
BayLDA hereby adopts this draft decision as final decision in accordance with Article 60(8) of the GDPR.
Ansbach, 05.05.2025