View source for AP (The Netherlands) - z2021-13185 / z2022-07180

{{DPAdecisionBOX

|Jurisdiction=Netherlands
|DPA-BG-Color=
|DPAlogo=LogoNL.png
|DPA_Abbrevation=AP
|DPA_With_Country=AP (The Netherlands)

|Case_Number_Name=z2021-13185 / z2022-07180
|ECLI=

|Original_Source_Name_1=Data subject
|Original_Source_Link_1=https://drive.google.com/file/d/1_sfb0MwyAk8us-GOKF7iwM-bqjGD2qjA/view?usp=share_link
|Original_Source_Language_1=Dutch
|Original_Source_Language__Code_1=NL
|Original_Source_Name_2=Data subject
|Original_Source_Link_2=https://drive.google.com/file/d/1_oYYEeI2S8v1MSca373726K1HvQq_DkY/view?usp=share_link
|Original_Source_Language_2=Dutch
|Original_Source_Language__Code_2=NL
|Original_Source_Name_3=
|Original_Source_Link_3=
|Original_Source_Language_3=
|Original_Source_Language__Code_3=

|Type=Complaint
|Outcome=Rejected
|Date_Started=17.07.2021
|Date_Decided=23.05.2023
|Date_Published=
|Year=2023
|Fine=
|Currency=

|GDPR_Article_1=Article 6 GDPR
|GDPR_Article_Link_1=Article 6 GDPR
|GDPR_Article_2=Article 28 GDPR
|GDPR_Article_Link_2=Article 28 GDPR
|GDPR_Article_3=Article 46 GDPR
|GDPR_Article_Link_3=Article 46 GDPR
|GDPR_Article_4=
|GDPR_Article_Link_4=
|GDPR_Article_5=
|GDPR_Article_Link_5=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=Jigler Payroll B.V.
|Party_Link_1=https://www.jigler.nl/
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=
|
}}

Jigler Payroll B.V. infringed on GDPR article 6, but infringement of GDPR article 28 and 46 could not be established. The AP decided not to take any enforcement action.

== English Summary ==

=== Facts ===
The data subject received direct marketing from an unknown company. After sending an access request this turned out a renamed payrolling company that was in possession of the email address for compliance with a legal obligation to which the controller is subject. Further investigation showed the email address had been processed in the USA by ActiveCampaign Ltd., but no signed agreement or SCCs were available. 6 months later agreements were made available which showed them to be signed only after the data subject started to ask for them.

=== Holding ===
The primary decision of the AP was that none of the alleged infringements were proven, the complaint did not meet the conditions for further investigation and no enforcement action would be taken. On appeal the AP adjusted the motivation to confirm that GDPR article 6 was infringed, but upheld the original decision not to take enforcement action.

== Comment ==
The position of the AP on the absence of a contract between the processor and controller appears to be rather problematic.
In the primary decision, the AP notes that it can not establish if a contract is in place without statements from Jigler or ActiveCampaign. Dutch administrative law can not compel an organisation to provide statements (only documents), so this position would effectively mean the AP is declaring article 28 GDPR unenforceable.
On appeal, the AP modifies its motivation and states there might have been an "implicit agreement" and it requires further investigation (which is not a priority).

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

<pre>
Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
Hoge Nieuwstraat 8, 2514 EL Den Haag
T 070 8888 500 - F 070 8888 501
autoriteitpersoonsgegevens.n1

Date              Our reference     Your complaint from
December 22, 2022 z2021-13185       July 17, 2021

Contact
********
070 8888 500

Subject
Decision in response to your complaint


Dear sir ********,

In the aforementioned case, the Dutch Data Protection Authority (hereinafter: 'AP') informs you as follows.

You will hereby receive the decision of the AP on your complaint, including the request for corrective measures (hereinafter: 'complaint') against Jigler Payroll B.V. (hereinafter: 'Jigler').

1. Summary of your complaint
On July 17, 2021, you filed a complaint against Jigler with the AP. Your complaint consists of three distinct grounds for complaint. You state that Jigler has violated the General Data Protection Regulation (hereinafter: 'GDPR') by:
  1. unlawfully process your personal data (Article 6 of the GDPR);
  2. not to conclude a (correct) processing agreement with a processor (Article 28 of the GDPR); and
  3. have your personal data processed in a third country, without taking appropriate safeguards (Article 46 of the GDPR).

Result of the complaint handling by the AP
The AP thanks you for the effort you have taken to submit a complaint to the AP. The AP has investigated your complaint. As a result of the investigation, the AP has sent a letter to Jigler in which Jigler is reminded of several rules from the GDPR. Namely, the rules regarding the lawful processing of personal data, the conclusion of a processing agreement if a processor is engaged and the taking of appropriate safeguards if personal data are processed in third countries. In practice, many organizations change their behavior or policy when they receive a letter from the AP.

1/13


PERSONAL DATA AUTHORITY
Date             Our reference
Dec 22, 2022     z2021-13185

Based on the available information, the AP has not been able to determine whether there has been a violation. This requires further research. The AP judges on the basis of the 'Policy rules prioritizing complaints investigation AP' (hereinafter: 'prioritizing criteria'') that your complaint does not meet the prioritizing criteria. For this reason, the AP will not investigate your complaint further. The AP explains what kind of research it has conducted and what it has determined on the basis of this. Subsequently, based on the assessment against the prioritization criteria, the AP will explain why your case does not lead to further investigation.

2. Assessment of your complaint
2.1. The manner in which the AP assesses your complaint
It follows from Article 57, first paragraph, opening lines and under f of the GDPR that the AP is obliged to investigate the content of the complaint to the extent that this is appropriate.

In your case, the AP has investigated and assessed your complaint on the basis of your complaint and associated documents, written information that the AP requested from Jigler, your opinion and information from the trade register of the Chamber of Commerce (hereinafter: 'KVK'). and the "WHOIS/Look-up tool" of the Internet Corporation for Assigned Names and Numbers (hereinafter:

By email of December 14, 2021, you withdrew a ground for complaint regarding the right of access (a possible violation of Article 12 in conjunction with Article 15 of the GDPR). The AP therefore disregards this ground for complaint in this decision.

2.2 Findings
Based on the investigation, the AP has reached the following general findings.

Background
In your complaint you indicate that you had a payroll agreement with P-Services plus B.V. from 1 July 2018 to 1 January 2019. This organization was your employer, but you worked for another company (********). P-Services plus B.V. has a new statutory and trade name as of April 23, 2020, namely Jigler. This follows from the history in the trade register of the Chamber of Commerce for the company with number 67200591.

Email dd. June 8, 2021 from figler to you
Your complaint specifically relates to the processing of your personal data in the context of an e-mail sent on 8 June 2021 (hereinafter: 'the e-mail') from the e-mail address infoajigler.nl to your e-mail address ***** *** has been sent. In the e-mail you were informed that there is a renewed website Jigler.n1. You were referred to open vacancies, a CV maker, how to apply for vacancies and the possibility of using a recruiter to find a suitable vacancy. The footer of the e-mail states: are you receiving this e-mail because you have worked via Jigler in the past or have registered at jiglernr, and 'Do you no longer wish to receive these e-mails? (click on) Unsubscribe', and 'Email Marketing by ActiveCampaign'.
' Policy rules prioritizing AP complaints investigation, published in the Government Gazette on October 1, 2018.

2/13


PERSONAL DATA AUTHORITY
Date             Our reference
Dec 22, 2022     z2021-13185

Lawfulness of the processing
Based on the investigation, the AP comes to the following findings regarding the lawfulness of the processing of your personal data.

In your complaint you state that the processing of your e-mail address for the purpose of sending the e-mail was unlawful. You substantiate this statement with copies of e-mails between you and Jigler. Jigler stated to you that the purpose and basis for the processing of your personal data is a legal obligation, namely keeping records for the Tax and Customs Administration.

In response to the AP's request for information, Jigler indicated that the purpose of the email was to inform the employee base about the revamped website and to provide job search assistance. Jigler stated that ex-employees who had been out of service for some time were also emailed due to an error. Jigler stated that she had adjusted her working method. Jigler no longer sends emails about company activities to employees who have been out of service for more than a year. In its response to the AP, Jigler did not specifically address the basis for the processing of your e-mail address for the e-mail, or whether the purpose they stated was a compatible purpose.

Processor ActiveCampaign
Based on the investigation, the AP comes to the following findings regarding the processing agreement and the transfer of your personal data to a third country.

In your complaint, you state that your email address has been processed by a processor in a third country. According to you, Jigler has not concluded a (correct) processing agreement with the processor. Furthermore, Jigler would not have taken appropriate safeguards that would make the transfer of your personal data to a third country lawful.

You base your statement on the basis of the e-mail. From this you inferred that these were provided by ActiveCampaign, Inc. (hereinafter: 'ActiveCampaign') has been sent. According to you, ActiveCampaign is the processor when sending the e-mail. You state that the email was sent from the IP address 52.128.40.74. It follows, according to you, that your e-mail address was processed in the United States.

You also sent copies of e-mails between you and Jigler with your complaint. From this, the DPA - summarized - concludes that Jigler stated to you that personal data is (exclusively) processed in Europe. Subsequently, Jigler stated to you that it has arranged in the cooperation agreement with ActiveCampaign that processing takes place in accordance with the GDPR.

In its request for information, the AP has asked Jigler to indicate whether your personal data has been processed by a processor and whether your personal data has been processed in a third country. In addition, the AP asked Jigler to indicate whether it had concluded a processing agreement and whether appropriate safeguards had been put in place to transfer your personal data to a third country. Jigler did not address these questions in her answer to the AP. Jigler indicated in her reply that you had partially withdrawn your complaint and that she assumed that only your complaint regarding legality would be upheld.

3/13


PERSONAL DATA AUTHORITY
Date             Our reference
Dec 22, 2022     z2021-13185
Date             Our reference
Dec 22, 2022     z2021-13185

In your opinion, you indicate that Jigler has had your e-mail address processed by ActiveCampaign without a processing agreement having been concluded. According to you, this follows from the fact that Jigler did not send the AP a copy of the processing agreement. It also follows from information that you have since received from Jigler that Jigler only concluded a processing agreement with ActiveCampaign on July 1, 2021. You sent a copy of this 'Audit Trail' that belongs to the 'Data Processing Addendum' with your opinion.

In your opinion, you also state that Jigler has not taken appropriate safeguards with regard to the transfer of your e-mail to a third country. According to you, this follows from the fact that Jigler did not send the AP a copy of the Standard Contractual Clauses (hereinafter: 'SCCs') that it allegedly concluded with ActiveCampaign. Furthermore, according to you, it follows from information that you had already received from Jiger that Jigler did not close SCCs with ActiveCampaign until July 1, 2021. You sent a copy of the 'Audit Trail' that belongs to the 'Standard Contractual Clauses' with your opinion.

Based on ICANN's lookup tool, the AP determines that the registrant of the IP address 52.128.40.74 is ActiveCampaign. ActiveCampaign's mailing address is in the United States.
Based on the findings, the AP will make the following assessment of your complaint.

2.3. Judgement
During the assessment, the AP checks on the basis of the findings whether Jigler has complied with the GDPR, or other relevant laws and regulations that the AP supervises. The legal framework against which the AP assesses is included in Appendix 1.

2.3.1 Grounds for complaint 1 — lawfulness of processing
Your first ground for complaint was that Jigler unlawfully processed your personal data when sending the e-mail to you.

To assess your first ground for complaint, the AP will check against Articles 5 and 6 of the GDPR. It follows from Article 5, first paragraph, under b of the GDPR that personal data is collected for specific, explicit and legitimate purposes. It also follows from this article that the personal data may not subsequently be further processed in a manner that is incompatible with those purposes. It follows from Article 6(1) of the AVG that the processing of personal data is lawful if one of the conditions under a to f is met. It follows from Article 6, paragraph 4 of the GDPR that, when assessing whether another purpose is compatible with the purpose for which the personal data were initially collected, a controller must take into account, among other things, the circumstances referred to in Article 6, paragraph 4, sub a to e of the GDPR.

Based on the available information, the AP cannot establish the facts about the purpose Jigler had in collecting your email address. Jigler has mentioned various purposes for (further) processing your e-mail address, namely complying with legal obligations and informing former employees about its new website and its services. Jigler also indicated that the email was sent to you by mistake. In addition, Jigler has not addressed the basis or compatibility of the purpose when processing your e-mail address. As a result, the AP cannot determine whether Jigler has violated Articles 5 and 6 of the GDPR. This requires further investigation by the AP.

4/13

PERSONAL DATA AUTHORITY
Date             Our reference
Dec 22, 2022     z2021-13185


23.2 Grounds for complaint 2 - processing agreement
Your second ground for complaint was that Jigler had your personal data processed by a processor, ActiveCampaign, without a processing agreement having been concluded.

To assess your second ground for complaint, the AP checks against Article 28 of the GDPR. It follows from Article 28, paragraph 3 of the GDPR that processing by a processor must be regulated in an agreement or other legal act under Union or Member State law that binds the processor towards the controller.

Based on the available information, the AP cannot determine with certainty that no processing agreement had been concluded between Jigler and ActiveCampaign at the time of the e-mail. You have sent information from which it would follow that a processing agreement was only concluded on July 1, 2021, i.e. after sending the e-mail. However, without statements from Jigler or ActiveCampaign, the AP cannot determine whether a processing agreement or another legal act was already in force before 1 July 2021 under Union or Member State law. As a result, the AP cannot determine whether Jigler has violated Article 28, paragraph 3 of the GDPR. This requires further investigation by the AP.

2.3.3 Grounds for complaint 3— transfer to third country
Your third ground for complaint was that Jigler has passed on your personal data to a third country, without appropriate safeguards being in place.

To assess your third ground for complaint, the AP must first establish that your personal data has been transferred to a third country. If the DPA determines this, the DPA will check, pursuant to Article 44 of the GDPR, whether the conditions laid down in Chapter V of the GDPR have been met.

Based on the available information, the AP cannot determine with certainty that your personal data has been transferred to a third country. First, the AP cannot determine with certainty that — as you state — the email was sent from the IP address 52.128.40.74. The AP would have to conduct (technical) research for this. In addition, according to the AP, it is not automatically established that if the e-mail was sent from the aforementioned IP address, the processing of your e-mail address then took place in the United States. Further investigation is required to determine whether your personal data has been transferred to a third country. The DPA therefore does not get to assess whether the (alleged) transfer has been carried out in accordance with Chapter V of the GDPR.

We will explain below why your complaint will not be investigated further.

3. Prioritization Criteria
Because the AP receives many signals and complaints and its field of supervision is extensive, given its limited resources, the AP cannot conduct a further investigation into every complaint. That is why the DPA checks against the prioritization criteria in situations in which there may be a violation, but for which further investigation is required to determine the violation.

Three factors are taken into account when testing against the prioritization criteria:
• the extent to which the alleged violation is harmful to the data subject;

5/13

PERSONAL DATA AUTHORITY
Date             Our reference
Dec 22, 2022     z2021-13185


• the extent to which further investigation and action by the AP has wider social significance;
• the extent to which the AP is able to act effectively and efficiently.

The AP considers the extent to which the alleged violation is harmful to you to be relatively limited. That is because the issue in question (exclusively) concerns the processing of your e-mail address. The processing of your e-mail address for sending the e-mail was known to be a one-off and Jigler has committed that you will not receive similar e-mails. The AP also considers it plausible, based on the available information, that Jigler has now concluded a processing agreement and SCCs with ActiveCampaign.

When assessing the extent to which there is a broader social significance, the AP takes into account, among other things, whether the complaint falls within the points of attention that the AP periodically announces2, whether a large group of people is affected and whether there is a cross-border nature. The AP considers the wider social significance of further investigation and action in your complaint to be relatively limited. Your complaint does not fall within the points for attention. The complaint has a cross-border element due to the (alleged) transfer of your e-mail address to the United States, but it has not emerged, for example, that (many) data subjects from several Member States would be affected and, as far as is known, it only concerns your e-mail address . It is not clear to the AP how many other parties involved received the e-mail.

With regard to the effectiveness and efficiency of action by the AP, the AP considers as follows. To establish a violation, the AP would have to question Jigler (again), and possibly also ActiveCampaign. In view of the fact that this only concerned the processing of your e-mail address, the AP does not consider it effective and efficient to use its limited capacity for further investigation into your complaint.

Based on the foregoing, the AP concludes that the prioritization criteria have not been sufficiently met to conduct further investigation. In addition, there are no special circumstances that stand in the way of the application of the prioritization criteria. Therefore, no further investigation will be carried out into your complaint. With this, the AP has investigated the content of your complaint to an appropriate extent.

Your complaint as a signal
However, the AP does regard your complaint as a signal. Your complaint is a valuable signal of Jigler's compliance with the law that the DPA can use to determine matters that require extensive investigation. For example, in response to one or more signals, the AP can start an in-depth investigation at a later time and possibly take enforcement measures. So your signal is always valuable. You can keep an eye on the AP website for information about completed investigations.

2 Focus 2020-2023: https://autoriteitpersoonsgegevens.nlinl/over-de-autoriteit-persoonsgegevens/focus-ap-2020-2023.

6/13

PERSONAL DATA AUTHORITY
Date             Our reference
Dec 22, 2022     z2021-13185


4. Decision
The AP rejects your complaint against Jigler, in which you also request corrective measures.

A copy of this decision will be sent to Jigler.

Yours faithfully,

Authority for Personal Data,
on their behalf

Head of the Primary Care Research Department



Objection
Do you have any comments, questions or would you like more information about this decision? Then call the contact person mentioned above.

Do you disagree with the content of this decision? Then you can submit a digital or paper objection to the Dutch Data Protection Authority within six weeks of the date on which the decision was sent. The notice of objection must be signed and must contain at least your name and address, the date and the reference referred to in this decision (case number). Furthermore, the notice of objection must include the reason(s) why you disagree with the decision.

For more information about how you can submit an objection, what an objection procedure entails, how the Dutch Data Protection Authority handles this and what is expected of you, see: https://autoriteitpersoonsgegevens.nlinl/bezwaar-maken

7/13




Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
Hoge Nieuwstraat 8, 2514 EL Den Haag
T 070 8888 500 - F 070 8888 501
autoriteitpersoonsgegevens.n1

Date            Our reference
May 22, 2023    z2022-07180

Contact
********
070 8888 500

Subject
Decision on objection


Dear sir ********,

You will hereby receive the decision of the Dutch Data Protection Authority (AP) on your notice of objection
December 29, 2022. The objection is directed against the decision of the AP of December 22, 2022 (reference z2021-13185), whereby the AP rejected your GDPR complaint of July 17, 2021. The decision of December 22, 2022 is hereinafter referred to as the primary decision. The AP declares your objection to be unfounded. This means that the AP will not take enforcement action against Jigler Payroll B.V. (hereinafter: Jigler). The AP explains its decision below.

For a summary of your complaint, the AP refers to the primary decision.

1. The relevant legal framework can be found as Appendix 1. The report of the hearing of 30 March 2023 can be found as appendix 2.

1. Assessment of your objection
Ground of objection 1: No basis for the processing.
2. You indicate that Jigler did not have a valid processing basis to send you the email of June 8, 2021. You argue that Jigler himself admitted this. You also argue that the AP's investigation into this aspect of your complaint was insufficient.

3. The AP determines that there has been a violation of the GDPR. The AP explains this as follows. Jigler herself indicated that she was not allowed to send the e-mail of June 8, 2021 due to the lack of a processing basis2. Jigler has also indicated that she has adapted her work processes to a

1 As referred to in Article 6 of the General Data Protection Regulation (hereinafter: GDPR)
2 Letter dated 17 December 2021.

1


PERSONAL DATA AUTHORITY
Date            Our reference
May 22, 2023    z2022-07180


prevent such processing in the future. Now that the violation is not in dispute between the parties, the AP establishes a violation with regard to sending the e-mail on 8 June 2021 without having a valid processing basis for it.3 However, there is no reason for enforcement action in this case. In the event of a violation, the AP is obliged to take enforcement action in the form of a remedial sanction in view of the principled duty of enforcement. However, it is not possible for the AP to undo (read: restore) this processing of personal data. Now that recovery cannot take place, enforcement by imposing a recovery sanction is no longer possible. In your specific case, the AP will further waive the imposition of a punitive sanction (fine). The violation is very minor. It only concerned the one-time sending of an email without special personal data. The AP also takes into account that Jigler has already acknowledged the unlawfulness of the processing and has apologized to you. Jigler has also indicated that it has already adjusted its standard working method and there is no longer any fear of repetition. The violation is also very minor. In view of the foregoing, the AP determines that your data has been processed unlawfully, but that in this case it will not take enforcement action because this would be disproportionate and the AP is not obliged to do so.4 Needless to say, the AP notes that if several similar complaints about this organization arise, the AP can reassess whether imposing a sanction is opportune.

4. Now that the AP has established a violation with regard to this part of the complaint, your argument regarding insufficient investigation into this violation no longer needs discussion.

Objection 2: No valid processing agreement and no appropriate guarantees for transfer
5. You argue that Jigler has passed on your personal data to a processor without a valid processing agreement. In your view, this would also involve a transfer without appropriate safeguards. You indicate that the AP's investigation is flawed because it did not request the processing agreement and the processing register from Jigler.

6. You have also added an e-mail from Jigler's company lawyer dated December 13, 2021 to your notice of objection, which contains the following passage:

"My apologies that you have not received the e-mails with the agreement and processing agreement. I am sending these to you in the attachment. The agreements were not yet signed by us at the time of your first e-mails to us, but of course they were ActiveCampaign offered to us in 2020.
We signed the agreements at the beginning of July 2021. And I thought I had also forwarded it to you afterwards, but apparently this did not happen. Again, My apologies."

7. In your opinion, this already sufficiently shows that no valid processing agreement had been concluded between Jigler and its processor at the time of the e-mail of June 8, 2021.
Judgment of the AP

3 As referred to in Article 6 of the GDPR. '
4 ECLI:NL:RVS:2021:1407 judgment of 30 June 2021.
2/5

PERSONAL DATA AUTHORITY
Date            Our reference
May 22, 2023    z2022-07180


8. Based on the passage from the e-mail of December 13, 2021 and the other information in the file, the AP cannot yet determine whether the GDPR has been violated. A processing agreement must be established in writing in accordance with the GDPR.5 According to the e-mail of December 13, 2021, the processing agreement was drawn up, but there was no signed version of this agreement at the time of processing. It follows from this that far-reaching negotiations were already underway between the controller and the processor to arrive at a processing agreement. It is unknown whether, at the time of the assessment of your GDPR complaint, the parties had already implicitly agreed on the content of the processing agreement. After all, giving an agreement to an agreement is free of form and Jigler may have agreed to the processing agreement in a way other than signing it.6 However, the AP cannot determine this on the basis of the information in the file and would have to investigate this further. . However, the AP waives this further investigation and will explain this in more detail below. Incidentally, the AP notes that at the time of the objection procedure, a signed processing agreement has still been found and this will be involved in the handling of your notice of objection.

9. As considered above, the AP has established a violation of the GDPR. It omits further investigation into possible other related violations of the GDPR with regard to the processing of your personal data. The AP does not consider a further investigation, for example by requesting documents, into the existence of a valid processing agreement and possibly suitable guarantees for transfer. The AP first of all notes that a processing agreement has now been signed. When deciding to refrain from further investigation, the AP also takes into account that it only concerns a one-off processing of regular, i.e. no special personal data and that the impact for you is therefore limited. The AP also considers it relevant that the e-mail of June 8, 2021 gave you the option to unsubscribe from future e-mails and thus prevent any further processing of your personal data in an accessible manner. In addition, the (possible) violations do not fall under the focus areas that the AP has determined for 2020-20237 and the possible violations with regard to your personal data have now ended without intervention by the AP.

10. Furthermore, in your case there are no special circumstances that mean that a further investigation must still be started, since it has not become apparent that the omission of a further investigation would lead to disproportionate consequences.
5 Article 28, ninth paragraph, of the GDPR.
6 For example verbally or by means of an e-mail stating that she has agreed.
7 Focus Authority Personal Data 2020-2023, see: https://autoriteitoersoonsdata.ni/n1/over-de-autoriteit-persoonsgegevensifocus-ap-2020-2023.

3/5

PERSONAL DATA AUTHORITY
Date            Our reference
May 22, 2023    z2022-07180


Other grounds of objection.
11. The AP does not follow your argument that the AP should conduct further investigation into whether there is currently a processing agreement8 and whether there are appropriate guarantees for transfers.9 The AP concludes from the documents that a processing agreement has now been signed and Jigler will no longer approach you for direct marketing' and that Jigler has also adjusted the work processes to prevent repetition of this case. Speculation about possible future violations falls outside the scope of this procedure and does not concern your personal data. These grounds of objection therefore require no further discussion.

2. Conclusion assessment of your grounds for objection
12. Pursuant to Section 7:11(1) of the General Administrative Law Act (Awb), the AP has reconsidered the contested decision in response to the objections raised. The AP concludes that it has rightly decided not to take enforcement action in your specific case, with an adjustment of the motivation. For that reason, the AP sees no reason to revoke its primary decision.

3. Operative part
The Dutch Data Protection Authority declares the objection unfounded.

I sent a copy of this decision to Jigler Payroll B.V.

Yours faithfully,
Autoriteit Persoonsgegevens,
in accordance with the decision taken by the Dutch Data Protection Authority,

********
Director of Legal Affairs and Legislative Advice


Remedies Clause
If you do not agree with this decision, you can submit a notice of appeal to the court (administrative law sector) in the district in which you live within six weeks of the date of dispatch of the decision pursuant to the General Administrative Law Act. You must enclose a copy of this decision. Submitting a notice of appeal does not suspend the effect of this decision.
8 As referred to in Article 28 of the GDPR.
9 As referred to in Article 46 GDPR.
10 It follows from the letter of 17 December 2021 that your removal request as referred to in Article 17 GDPR has been complied with. You have this
part of your primary complaint has been withdrawn from the AP, which sufficiently demonstrates that your personal data will no longer be processed
processed by Jigler

4/5

PERSONAL DATA AUTHORITY
Date            Our reference
May 22, 2023    z2022-07180


Costs are payable to the court for filing an appeal with the court (court fee). The amount of these costs can be found on the internet page of the judiciary: https://www.rechtspraak.nl/Naar-de-rechter/Kosten-rechtszaak/Griffierecht/Paginas/Griffierecht-bestuursrechtaspx
5/5
</pre>