ADA (Lithuania) - 2024-02-23: Difference between revisions

Latest revision as of 11:34, 19 June 2024

ADA - 2024-02-23

Authority:	ADA (Lithuania)
Jurisdiction:	Lithuania
Relevant Law:	Article 6(1)(b) GDPR Article 6(1)(f) GDPR Article 21(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	23.02.2024
Published:	08.06.2024
Fine:	n/a
Parties:	n/a
National Case Number/Name:	2024-02-23
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Lithuanian
Original Source:	ADA (Valstybinė duomenų apsaugos inspekcija - VDAI) (in LT)
Initial Contributor:	Alexander Shpiliauskas

The DPA reprimanded a controller for failing to honor the data subject's right to object to receiving payment reminders, even though the data subject consistently made timely payments.

English Summary

Facts

A provider of electronic communications services ('controller) provided services to a customer ('data subject') under a contract.

The data subject filed a complaint with the DPA and stated that he received the controller's bill payment reminders, which were sent to the applicant's email address on monthly basis, although the data subject paid the bills for services on time. The data subject indicated and provided evidence that he had repeatedly asked the controller not to send these reminders. Additionally, he was not provided with any opt-out option from receiving the unwanted emails.

The controller indicated that reminders were sent to the data subject due to the necessity to perform the contract in accordance with Article 6(1)(b) GDPR. Additionally, the controller presented arguments regarding the possibility of applying a legitimate interest condition as per Article 6(1)(f) GDPR, emphasizing data controller’s interest in receiving payment for services on time.

The controller admitted that the data subject had always paid the bills by the dates specified in the controller's documents and reminders.

Holding

The DPA held that the controller could not justify the processing of the data based on Article 6(1)(b) GDPR. The processing of the data subject's email address for the purpose of sending reminders was not necessary in order to fulfill the contract concluded with the data subject.

Furthermore, the DPA found that processing based on the controller's legitimate interest under Article 6(1)(f) GDPR is in principle possible, however the controller must prove, in each case of refusal to honor an objection, that the reasons for processing outweigh the data subject's interests, rights, and freedoms.

As a result, the controller's refusal to honor the data subject's objection to the processing of their e-mail address constituted a violation of Article 21(1) GDPR.

Therefore, the data subject's complaint was accepted and the controller received instructions to satisfy the data subject's request to implement the right to object with the processing of their email address for sending payment reminders.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Lithuanian original. Please refer to the Lithuanian original for more details.

@@ Line 49: / Line 49: @@
 |National_Law_Link_2=
-|Party_Name_1=Customer (applicant)
+|Party_Name_1=
 |Party_Link_1=
-|Party_Name_2=Provider of electronic communications services (data controller)
+|Party_Name_2=
 |Party_Link_2=
 |Party_Name_3=
@@ Line 67: / Line 67: @@
 }}
-An electronic communications service provider was reprimanded for a failure to honor the data subject's right to object to receiving bill payment reminders, even though the data subject consistently made timely payments.
+The DPA reprimanded a controller for failing to honor the data subject's right to object to receiving payment reminders, even though the data subject consistently made timely payments.
 == English Summary ==
 === Facts ===
-A provider of electronic communications services ('controller) was providing services to a customer ('data subject') under a contract.
+A provider of electronic communications services ('controller) provided services to a customer ('data subject') under a contract.
-The data subject filed a complaint with the DPA and stated that he received the controller's bill payment reminders, which are sent to the applicant's email address on monthly basis, although the data subject paid the bills for services on time. The data subject indicated and provided evidence that he had repeatedly asked the controller not to send these reminders. Additionally, he was not provided any alternative to opt-out from receiving the unwanted emails.
+The data subject filed a complaint with the DPA and stated that he received the controller's bill payment reminders, which were sent to the applicant's email address on monthly basis, although the data subject paid the bills for services on time. The data subject indicated and provided evidence that he had repeatedly asked the controller not to send these reminders. Additionally, he was not provided with any opt-out option from receiving the unwanted emails.
 The controller indicated that reminders were sent to the data subject due to the necessity to perform the contract in accordance with [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]]. Additionally, the controller presented arguments regarding the possibility of applying a legitimate interest condition as per [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], emphasizing data controller’s interest in receiving payment for services on time.
-The DPA found that:
+The controller admitted that the data subject had always paid the bills by the dates specified in the controller's documents and reminders.
-(i) none of the documents submitted by the controller to the DPA stipulate that the reminders were sent, if data subject did not pay the bill by a certain date;
-(ii) the controller admitted that the data subject had always paid the bills by the dates specified in the controller's documents and reminders;
-(iii) the controller did not provide any evidence that the data subject breached the payment conditions established by the contract.
 === Holding ===
-The DPA held that the controller could not justify the processing of the data subject data based on [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]]. Based on the DPAI, the processing the data subject's email address for the purpose of sending reminders was not necessary in order to fulfill the contract concluded with the data subject.
+The DPA held that the controller could not justify the processing of the data based on [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]]. The processing of the data subject's email address for the purpose of sending reminders was not necessary in order to fulfill the contract concluded with the data subject.
-Furthermore, it was held that processing based on the controller's legitimate interest under Article 6(1)(f) GDPR is possible, however the controller must prove, in each case of refusal to honor an objection, that the reasons for processing outweigh the data subject's interests, rights, and freedoms.
+Furthermore, the DPA found that processing based on the controller's legitimate interest under Article 6(1)(f) GDPR is in principle possible, however the controller must prove, in each case of refusal to honor an objection, that the reasons for processing outweigh the data subject's interests, rights, and freedoms.
-As a result, the controller's refusal to implement the data subject's right to object with the processing their e-mail address constituted a violation of [[Article 21 GDPR#1|Article 21(1) GDPR]].
+As a result, the controller's refusal to honor the data subject's objection to the processing of their e-mail address constituted a violation of [[Article 21 GDPR#1|Article 21(1) GDPR]].
 Therefore, the data subject's complaint was accepted and the controller received instructions to satisfy the data subject's request to implement the right to object with the processing of their email address for sending payment reminders.