ADA (Lithuania) - 2024-02-23: Difference between revisions
(Created page with "{{DPAdecisionBOX |Jurisdiction=Lithuania |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoLT.png |DPA_Abbrevation=ADA |DPA_With_Country=ADA (Lithuania) |Case_Number_Name=On the right to disagree, when the data subject does not agree to receive reminders regarding the payment of the service bill |ECLI= |Original_Source_Name_1=ADA (Valstybinė duomenų apsaugos inspekcija - VDAI) |Original_Source_Link_1=https://vdai.lrv.lt/media/viesa/saugykla/2024/6/8_zcLbuxFqE.pdf...") |
mNo edit summary |
||
| Line 81: | Line 81: | ||
The DPA found that: | The DPA found that: | ||
(i) none of the documents submitted by the data controller to the Lithuanian DPA stipulate that the reminders will be sent, if customer (the applicant) would not pay the bill by a certain date, e. g., by the 25th of the current month; | (i) none of the documents submitted by the data controller to the Lithuanian DPA stipulate that the reminders will be sent, if customer (the applicant) would not pay the bill by a certain date, e. g., by the 25th of the current month; | ||
(ii) the payment deadline was the last day of the month according to the reminders and documents, which were indicated by the data controller; | (ii) the payment deadline was the last day of the month according to the reminders and documents, which were indicated by the data controller; | ||
(iii) the data controller admitted that the applicant had always paid the bills by the dates specified in the data controller's documents and reminders; | (iii) the data controller admitted that the applicant had always paid the bills by the dates specified in the data controller's documents and reminders; | ||
(iv) the data controller did not provide any evidence that the applicant breached the payment conditions established by the contract. | (iv) the data controller did not provide any evidence that the applicant breached the payment conditions established by the contract. | ||
| Line 88: | Line 91: | ||
=== Holding === | === Holding === | ||
The DPA held that: | The DPA held that: | ||
(i) usage of the applicant's email address for the purpose of sending reminders was not necessary in order to fulfill the contract concluded with the applicant, therefore the data controller cannot justify the legality of his actions (within the scope of the complaint) on the basis of the contract fulfillment (i. e., with [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]]). | (i) usage of the applicant's email address for the purpose of sending reminders was not necessary in order to fulfill the contract concluded with the applicant, therefore the data controller cannot justify the legality of his actions (within the scope of the complaint) on the basis of the contract fulfillment (i. e., with [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]]). | ||
(ii) the data controller can send reminders to its customers (data subjects) regarding regular monthly bill payment for services in accordance with Article 6(1)(f) of the GDPR (i.e., on the basis of legitimate interest), but the data controller has to prove in each specific case (of refusal to implement data subject's right to disagree with the usage of data subject’s personal data for sending payment reminders) that the reasons for the personal data processing are superior to the interests, rights and freedoms of the data subject after the data subject expresses disagreement regarding usage of data subject's personal data for the purposes of delivery of the reminders. | (ii) the data controller can send reminders to its customers (data subjects) regarding regular monthly bill payment for services in accordance with Article 6(1)(f) of the GDPR (i.e., on the basis of legitimate interest), but the data controller has to prove in each specific case (of refusal to implement data subject's right to disagree with the usage of data subject’s personal data for sending payment reminders) that the reasons for the personal data processing are superior to the interests, rights and freedoms of the data subject after the data subject expresses disagreement regarding usage of data subject's personal data for the purposes of delivery of the reminders. | ||
(iii) the data controller was processing data subject’s e-mail address for the purpose of sending reminders on the basis of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], therefore refusal to implement the applicant's right to disagree with processing of the data subject’s e-mail address constituted violation of [[Article 21 GDPR#1|Article 21(1) GDPR]]. | (iii) the data controller was processing data subject’s e-mail address for the purpose of sending reminders on the basis of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], therefore refusal to implement the applicant's right to disagree with processing of the data subject’s e-mail address constituted violation of [[Article 21 GDPR#1|Article 21(1) GDPR]]. | ||
Revision as of 11:34, 15 June 2024
| ADA - On the right to disagree, when the data subject does not agree to receive reminders regarding the payment of the service bill | |
|---|---|
 | |
| Authority: | ADA (Lithuania) |
| Jurisdiction: | Lithuania |
| Relevant Law: | Article 6(1)(b) GDPR Article 6(1)(f) GDPR Article 21(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 23.02.2024 |
| Published: | 08.06.2024 |
| Fine: | n/a |
| Parties: | Customer (applicant) Provider of electronic communications services (data controller) |
| National Case Number/Name: | On the right to disagree, when the data subject does not agree to receive reminders regarding the payment of the service bill |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Lithuanian |
| Original Source: | ADA (Valstybinė duomenų apsaugos inspekcija - VDAI) (in LT) |
| Initial Contributor: | Alexander Shpiliauskas |
Client’s e-mail address processing for the purpose of sending reminders on the basis of legitimate interest does not justify refusal to implement client's right to disagree with processing of the client’s e-mail address (violation of Article 21(1))
English Summary
Facts
The provider of electronic communications services (hereinafter - the data controller) had been providing services to the customer (hereinafter - the applicant) under the contract.
The applicant filed a complaint with Lithuanian Data Protection Authority (hereinafter - DPA) and stated that he receives the data controller's bill payment reminders, which are sent to the applicant's email address every month, although the applicant pays the bills for services on time. The applicant indicated and provided evidence that he had repeatedly asked the data controller not to send reminders to the applicant. The applicant was not given any alternative to opt out of unwanted emails. The applicant requested the DPA to give him the opportunity to opt out of receiving reminders of such content.
The data controller indicated that reminders were sent to the applicant in accordance with Article 6(1)(b) GDPR and presented arguments regarding the possibility of applying a legitimate interest condition, i.e. Article 6(1)(f) GDPR, emphasizing data controller’s interest in receiving payment for services on time.
The DPA found that:
(i) none of the documents submitted by the data controller to the Lithuanian DPA stipulate that the reminders will be sent, if customer (the applicant) would not pay the bill by a certain date, e. g., by the 25th of the current month;
(ii) the payment deadline was the last day of the month according to the reminders and documents, which were indicated by the data controller;
(iii) the data controller admitted that the applicant had always paid the bills by the dates specified in the data controller's documents and reminders; (iv) the data controller did not provide any evidence that the applicant breached the payment conditions established by the contract.
Holding
The DPA held that:
(i) usage of the applicant's email address for the purpose of sending reminders was not necessary in order to fulfill the contract concluded with the applicant, therefore the data controller cannot justify the legality of his actions (within the scope of the complaint) on the basis of the contract fulfillment (i. e., with Article 6(1)(b) GDPR).
(ii) the data controller can send reminders to its customers (data subjects) regarding regular monthly bill payment for services in accordance with Article 6(1)(f) of the GDPR (i.e., on the basis of legitimate interest), but the data controller has to prove in each specific case (of refusal to implement data subject's right to disagree with the usage of data subject’s personal data for sending payment reminders) that the reasons for the personal data processing are superior to the interests, rights and freedoms of the data subject after the data subject expresses disagreement regarding usage of data subject's personal data for the purposes of delivery of the reminders.
(iii) the data controller was processing data subject’s e-mail address for the purpose of sending reminders on the basis of Article 6(1)(f) GDPR, therefore refusal to implement the applicant's right to disagree with processing of the data subject’s e-mail address constituted violation of Article 21(1) GDPR.
Therefore, the applicant's complaint was accepted as justified and the instruction was given to the data controller to satisfy the applicant's request (to implement the right to disagree with the usage of applicant’s email address for sending payment reminders).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Lithuanian original. Please refer to the Lithuanian original for more details.
