BayLDA (Bavaria) - LDA-1085.1-10821/21-F

BayLDA - LDA-1085.1-10821/21-F
Authority:	BayLDA (Bavaria)
Jurisdiction:	Germany
Relevant Law:	Article 5(1)(b) GDPR Article 12 GDPR Article 14 GDPR Article 18 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	21.12.2023
Published:
Fine:	n/a
Parties:	CRIF Bürgel
National Case Number/Name:	LDA-1085.1-10821/21-F
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	German
Original Source:	Noyb (in DE)
Initial Contributor:	ec

The DPA held that it is unlawful to use data that was collected for marketing purposes to assess the creditworthiness of data subjects as this further processing violates the principle of purpose limitation under Article 5(1)(b) GDPR.

English Summary

Facts

Controller 1, the credit reference agency CRIF Bürgel, bought personal data, such as the names, addresses and dates of birth of millions of Germans, including of the data subject, from controller 2, the address trader Acxiom, who collected this personal data for direct marketing purposes. Controller 1 used this personal data to assess the creditworthiness of individuals.

The data subject requested access to a copy of his data and the information on the processing of his personal data under Article 15 GDPR. Controller 1 replied with information on which personal data was available. However, controller 1 did not provide the data subject with any information on the exact date of receiving the data from controller 2, the storage period, the disclosure of data to certain recipients and the purposes of the transfer. Even after multiple letters and reminders by the data subject to provide this information, the controller did not respond.

The data subject also requested controller 1 to restrict the processing of his personal data under Article 18 GDPR. Controller 1 argued that the right to restrict processing only existed if the data in question were incorrect, and therefore rejected the data subject’s request for restriction.

The data subject, represented by noyb, then filed a complaint at the Bavarian DPA (“Bayerisches Landesamt für Datenschutzaufsicht”) against controller 1. The data subject, again represented by noyb, filed another complaint at the Hessian DPA (“Hessischer Beauftragter für Datenschutz und Informationsfreiheit “) against controller 2. This summary is on the decision of the Bavarian DPA and thus only concerns controller 1.

The data subject argued that controller 1 violated Article 5(1)(b) GDPR, Article 14 GDPR, Article 15 GDPR and Article 18 GDPR.

Regarding the violation of Article 5(1)(b) GDPR, the data subject argued that the processing of personal data received from controller 2 by controller 1 violated the principle of purpose limitation. Controller 1 argued that this was not "new processing" as they already had the same personal data on the data subject when it obtained the personal data from controller 2.

Regarding the violation of Article 14 GDPR, the data subject argued that he never received any information on the further processing for purposes of creditworthiness assessment by controller 1. This infringed upon the information obligations the controller had under Article 14 GDPR.

Regarding the violation of Article 18 GDPR, the data subject argued that it was unlawful to reject the request for restriction of processing, as the data subject did not base his request on the accuracy of personal data under Article 18(1)(a) GDPR. In fact, the data subject based their request on the unlawfulness of the processing under Article 18(1)(b) GDPR and the pending verification whether the legitimate grounds of the controller override those of the data subject under Article 18(1)(d) GDPR.

Holding

The DPA rejected controller 1’s argument that it was not "new processing". The DPA explained that controller 1 could still conclude from receiving controller 2's data that the data subject was still a resident at the current address that controller 1 had stored in their system. Therefore, the DPA held that the data subject should have been informed no later than one month after obtaining the data from controller 2, in accordance with Article 14 GDPR. As this did not happen, the DPA held there was a breach of the information obligation under Article 14(1) GDPR and Article 14(3)(a) GDPR.

The DPA further held that controller 2’s processing for the purpose of direct marketing and controller 1’s processing for the purpose of assessing the creditworthiness of individuals were not compatible. The DPA therefore held that controller 1 was in violation with Article 5(1)(b) GDPR and Article 6(4) GDPR.

The DPA also found that controller 1 did not provide the data subject with complete information after an access request under Article 15 GDPR. The data subject did not receive the date that his personal data, specifically his address, was processed by the controller. The DPA held that the controller’s lack of answers to the access request violated Article 12(3) GDPR and Article 12(4) GDPR, which obligates the controller to provide information to the data subject without undue delay.

The DPA informed the controller that they would have to erase the personal data of the data subject as soon as the data subject withdraws his request to restrict processing under Article 18(1)(b) GDPR.

The DPA further issued two warnings to the controller in accordance with Article 58(2)(b) GDPR on the violations of Article 14(1) GDPR, Article 14(3)(a) GDPR and Article 5(1)(b) GDPR in conjunction with Article 6(4) GDPR. The DPA also issued a warning to the controller that stated that comparable processing operations in relation to other data subjects, even if they are carried out on the basis of any comparable contracts with other data suppliers, would also constitute an unauthorised change of purpose and violate the principle of purpose limitation.

The DPA also ordered the controller to not further process personal data of the data subject with a different purpose.

The DPA also held it will conduct further proceedings against the controller to closer examine a general ban on the purchase of data from address traders such as controller 2.

Comment

The DPA followed a ruling by the Austrian DPA (DSB 2023-0.193.268) from March 2023. This case, also filed by noyb, was against the Austrian branch of the controller and the DPA held that secret trading between credit agencies and address traders violates the GDPR and is therefore illegal.

The proceedings against controller 2, Axciom, which is handled by the Hessian DPA is behind schedule. The controller went to court to prevent the data subject from accessing the case files. This brought the entire proceedings to a standstill. The court has now rejected Acxiom’s application as inadmissible, but has not issued a decision yet.

The decision against CRIF however is in force, as the controller did not appeal it according to the DPA. In the aftermath of the decision, the data subject sent an access request to the controller, who replied that they do not process any data on the data subject. By erasing the data prior to the data subject's withdrawal of his request of restriction, the controller violated Article 18(1)(b) GDPR and furthermore ignored the DPA's notice that the data should only be erased once the data subject says so.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Your reference: C044, (partial) final notice LDA-1085.1-10821/21-F

Subject: Your reference: C044, (partial) final notice LDA-1085.1-10821/21-F

From: "XXXX, XXXX (LDA)" <XXXXXXXX@lda.bayern.de>

Date: December 21, 2023, 1:58 p.m.

To: Legal <legal@noyb.eu>

Your reference: C044

------------------------------------------------
File number: LDA-1085.1-10821/21-F

Dear Sir or Madam,

we are coming back to the above-mentioned complaint of October 18, 2021 and inform you

as a result of the following:

As already roughly explained in our conversation on September 29, 2023, the following findings have arisen for us in the proceedings:

- At the beginning of July 2018, and from then on at other points in time when Acxiom contractually obtained data from the

complainant, CRIF collected/obtained data from Acxiom within the meaning of Art. 14 Para. 1, 3 lit. a GDPR.

CRIF had essentially argued that this was not new processing, since the data was already known to CRIF as delivered. This argument was not convincing for us, since CRIF could at least deduce from the delivery

as a new date that the complainant was still resident at the current address stored with CRIF at the time of delivery, also based on the data from Acxiom. This would have made it obligatory to provide information to the complainant in accordance with Art. 14 GDPR no later than one month after this data delivery.

This did not happen or only happened several years later, so there is a violation of the obligation to provide information under Art. 14 Para. 1, 3 lit. a GDPR.

- Likewise, in the aforementioned processing under the GDPR, CRIF disregarded the fact that the

purpose of processing at Acxiom was direct marketing, while CRIF used the data for the purposes of assessing

creditworthiness in commercial transactions.

This change in the purpose of processing could not be legitimized by Art. 6 Para. 4 GDPR. The purposes are not

compatible. The provisions of Section 24 BDSG are also not applicable, so that overall an inadmissible

change of purpose was made contrary to Art. 5 Para. 1 lit. b in conjunction with Art. 6 Para. 4 GDPR.

In addition to this general violation, the transmission to EOS also constitutes a violation of Art. 5 Para. 1 lit. b

in conjunction with Art. 6 Para. 4 GDPR, since this was at least partly based on the data that was subject to the inadmissible

change of purpose.

- Furthermore, the following deficiencies in particular existed in the processing of the complainant's requests:

The complainant did not receive complete information, in any case because it was not stated since when his

address data record had been processed at CRIF, although this allows conclusions to be drawn about his minimum period of residence at the address

and represents personal data.

In general, with regard to the complainant's requests, it is noticeable that the answers repeatedly did not comply with the content and

deadline-determining requirements of Art. 12 Para. 3 Sentence 1 or Art. 12 Para. 4 GDPR, and in any case the answer

of April 8, 2021 reproduced information that was inaccurate in its general nature in such a way that it was suggested that rights to

correction, deletion and restriction at CRIF would only be considered if the data processed

were incorrect.

Based on the above findings, we have initiated the following measures:

1 of 4 12/21/2023, 4:48 p.m. Your reference: C044, (partial) final notification LDA-1085.1-10821/21-F

- Regarding the deficiencies in the handling of the data subject's requests, we have informed CRIF of the violations but, within the scope of

our discretion, have refrained from taking further supervisory measures under Art. 58 (2) GDPR for the time being.

This does not affect any further official audits that are planned (see below).

- With regard to the complainant's data, for which an inadmissible change of purpose was made in accordance with our statements above or possibly in a comparable manner under the GDPR, we have informed CRIF that deletion must take place immediately as soon as the person concerned withdraws his request to restrict processing and consent for processing within the meaning of Art. 6 Paragraph 1 Subparagraph 1 Letter a of GDPR is not simultaneously proven. - With regard to the violations of Art. 14 Paragraph 1, 3 Letter a of GDPR and Art. 5 Paragraph 1 Letter b in conjunction with Art. 6 Paragraph 4 GDPR that occurred in the complainant's case, we have issued CRIF with two supervisory warnings in accordance with Art. 58 Paragraph 2 Letter b of GDPR. With reference to the legal findings of these warnings, we have also issued a supervisory warning to CRIF pursuant to Art. 58 (2)(a) GDPR to the effect that comparable processing in relation to other data subjects, even if carried out on the basis of any comparable contracts with other data suppliers, would also constitute an impermissible change of purpose contrary to the data protection principle of purpose limitation on the part of CRIF. This does not affect any further official examinations that are intended (see below). - We have also requested confirmation from CRIF that further comparable processing that changes the purpose will not be carried out in relation to the complainant. The most recent response we received from CRIF on this matter is as follows: "Our client [note: BayLDA: CRIF] hereby confirms that it will not process the complainant's personal data for a purpose other than that of the complainant, in such a way that the complainant's personal data, which it has or will collect in accordance with the contract for the purpose of direct marketing and not for the purpose of assessing creditworthiness, will be processed by way of a change of purpose for assessing creditworthiness without the complainant's consent." According to our current assessment, this confirmation does not fully cover the processing that we consider to be inadmissible. Before we therefore examine a supervisory ban, however, we consider it necessary to wait for the assessment by the supervisory authority in Hesse on the processing by Acxiom, which is closely related to the processing considered here at CRIF, so that we are postponing a decision on this point. On this point, therefore, only a partial conclusion is made, which is also made clear to CRIF. This does not affect any further intended official examinations (see below). In addition to these measures, we have already expressly reserved the following further steps towards CRIF. Since it appears more effective in the context of data protection enforcement to look at the underlying data protection processes

rather than just the handling in the individual case at hand, their review / implementation should, as already explained on

September 29, 2023, be carried out step by step in separate official proceedings, detached from the individual case at hand:

- A closer official review of the practice of inadmissible changes of purpose, which we consider to be more far-reaching / systematic based on the present case.

- A closer official review of the admissibility of processing data of data subjects (also outside of

industry pools) without there being any negative characteristics for these data subjects.

- A closer official review of whether CRIF generally complies with the standards and

specifications of Art. 13 and 14 GDPR in conjunction with Art. 12 GDPR when fulfilling its information obligations, as doubts arose in this regard, among other things, during the processing of the present case.

2 of 4 December 21, 2023, 4:48 p.m. Your reference: C044, (partial) final notice LDA-1085.1-10821/21-F

- A closer examination ex officio as to whether the information provided by CRIF meets the requirements of Art. 15 GDPR;

for example, more specifically, whether it generally contains all personal data that CRIF processes on data subjects, whether the information meets the requirements of Art. 15 Para. 1 lit. g GDPR and whether the obligations of

Art. 15 Para. 1 lit. c GDPR are sufficiently fulfilled.

- We have also reserved the right to include the findings of the present proceedings in any future

fine proceedings or to take them up independently.

With these findings / measures, we are discontinuing the complainant's individual case for the time being (see above, regarding
Partial conclusion of any ban).

Without prejudice to our position, affected persons have the opportunity to assert alleged violations in parallel /
additionally directly in civil court against a responsible party (Art. 79 GDPR). The civil courts
are independent in their decision and are not bound by our assessments. Any decisions on compensation

for damage suffered, if such should be assumed, would be reserved exclusively for the civil courts,
so we make no statement in this regard.

Kind regards

XXXX
Department 1
Bavarian State Office for Data Protection Supervision

Promenade 18
91522 Ansbach
Tel.: 0981 180093113

PC fax: 0981 180093813
Email: XXXXXXXX@lda.bayern.de https://www.lda.bayern.de

Information on the processing of your personal data:
The Bavarian State Office for Data Protection Supervision is responsible for the processing of your personal data in the context of the

present contact. Further information on the processing of your data, in particular on

the rights to which you are entitled, can be found on our homepage at

www.lda.bayern.de/Informationen or by any other means using the above-mentioned

contact details.

Instructions on legal remedies

With reference to Articles 77 and 78 of the GDPR, we would like to point out that an appeal can be lodged against this

decision with the

Bavarian Administrative Court of Ansbach,

Promenade 24-28, 91522 Ansbach

Information on instructions on legal remedies

The appeal can be lodged in writing, in writing or electronically in

a form approved for replacing the written form. The filing of an

appeal by simple email is not permitted and has no

legal effect!

3 of 4 December 21, 2023, 4:48 p.m. Your reference: C044, (partial) final notice LDA-1085.1-10821/21-F

From January 1, 2022, the group of people named in Section 55d of the Administrative Court Act (VwGO)

(in particular lawyers) must generally file lawsuits electronically.

By virtue of federal law, in legal proceedings before the administrative courts, a procedural fee is due as a result of the filing of the action.

4 of 4 12/21/2023, 4:48 p.m.