UODO (Poland) - ZSPR.440.331.2019.PR.PAM: Difference between revisions
Arapcewicz (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Poland |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoPL.png |DPA_Abbrevation=UODO (Poland) |DPA_With_Country=UODO (Poland) |Case_Number...") |
Arapcewicz (talk | contribs) m (→Holding) |
||
| Line 63: | Line 63: | ||
=== Holding === | === Holding === | ||
The Polish supervisory authority ordered the controller to provide the data subject with information on the marketing categories (behavioural profile) attributed to him/her on the basis of cookies, and to indicate what information concerning him/her has been linked to the cookie information | The Polish supervisory authority ordered the controller to provide the data subject with information on the marketing categories (behavioural profile) attributed to him/her on the basis of cookies, and to indicate what information concerning him/her has been linked to the cookie information. | ||
The supervisory authority pointed out that behavioural profiling involves tailoring advertising to topics of interest to the internet user, and this process is based on the internet user's behaviour and then displaying advertising on topics to which the user spends a large amount of time while surfing the internet. The collection of information about an internet user is inextricably linked to profiling, the key aim of which is to match relevant advertising to a specific person, based on inferences about that person's expected characteristics and needs. | The supervisory authority pointed out that behavioural profiling involves tailoring advertising to topics of interest to the internet user, and this process is based on the internet user's behaviour and then displaying advertising on topics to which the user spends a large amount of time while surfing the internet. The collection of information about an internet user is inextricably linked to profiling, the key aim of which is to match relevant advertising to a specific person, based on inferences about that person's expected characteristics and needs. | ||
The | The supervisory authority pointed out that the controller creates a state of uncertainty for the data subject by failing to take a uniform, transparent and reliable view of the content of the data being processed, in particular what marketing categories (behavioural profile) have been attributed to the data subject on the basis of cookies and with what other information about a specific natural person the information resulting from those cookies has been combined. The information provided must be clear, understandable and sufficiently precise to enable the user to understand the functioning of the cookies that are used. | ||
The supervisory authority considered that the controller did not provide the data subject with complete information pursuant to [[Article 15 GDPR#1|Article 15(1) GDPR]]. Indeed, the controller's response lacked information on the marketing categories (behavioural profile) that were assigned to the data subject on the basis of the cookies and with which other information about her the information resulting from the cookies was combined. | The supervisory authority considered that the controller did not provide the data subject with complete information pursuant to [[Article 15 GDPR#1|Article 15(1) GDPR]]. Indeed, the controller's response lacked information on the marketing categories (behavioural profile) that were assigned to the data subject on the basis of the cookies and with which other information about her the information resulting from the cookies was combined. | ||
== Comment == | == Comment == | ||
'' | ''The decision has not yet been published on the website of the Data Protection Authority, but has been made available on the website of the law firm in anonymised form. Due to the PDF format (scan) the translation requires a lot of time and will therefore be made available at a later date.'' | ||
== Further Resources == | == Further Resources == | ||
https://panoptykon.org/uodo-mamy-prawo-poznac-swoj-profil-marketingowy | |||
== English Machine Translation of the Decision == | == English Machine Translation of the Decision == | ||
Revision as of 09:44, 5 December 2021
| UODO (Poland) - ZSPR.440.331.2019.PR.PAM | |
|---|---|
 | |
| Authority: | UODO (Poland) |
| Jurisdiction: | Poland |
| Relevant Law: | Article 15(1) GDPR Article 58(2)(c) GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 07.10.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | ZSPR.440.331.2019.PR.PAM |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Polish |
| Original Source: | KLM Law (in PL) |
| Initial Contributor: | Agnieszka Rapcewicz |
The Polish DPA ordered the controller to provide the data subject with information on the marketing categories attributed to her on the basis of cookies, and to indicate which information concerning her was linked to the cookie information. The information must be clear, understandable and sufficiently precise to enable the user to understand the functioning of the cookies that are used.
English Summary
Facts
The data subject filed a complaint with the DPA about irregularities in the processing of her personal data consisting of a failure to comply with the obligation under Article 15(1) GDPR towards her. The controller obtained the data subject's personal data, stored in cookies, by means of a terminal device of which the data subject was a user, in connection with browsing the website. The controller processes the data subject's personal data in order to provide services of access to the resources of the web portal, services and applications, as well as to pursue legitimate interests in the detection and prevention of abuse of the telecommunications network, for analytical purposes and the adjustment of online advertising. The controller does not make cookies available to other entities, but enables such entities (with which it has concluded agreements) to embed cookies in its domain by providing it with specific functionalities.
The data subject in July 2018 requested a copy of her personal data from the controller, as well as information on the processing of: which of her personal data is processed, the legal basis and the purposes of the processing in the context of the different groups of cookies (if this is also the case for other of her data), the sources of acquisition of her data, the recipients of her personal data, information on profiling and automated decision-making in the context of the content displayed to her based on the controller's collection, and concerning the content of her personal data, in particular what marketing categories (behavioural profile) have been attributed to her on the basis of cookies and with which other information about the data subject the information resulting from cookies has been combined.
The controller provided information, but the data subject stated that it was not complete and requested again information about what marketing categories (behavioural profile) have been attributed to her on the basis of cookies and with which other information about the data subject the information resulting from cookies has been combined. The controller indicated that he had provided complete information. The data subject lodged a complaint with the DPA.
Holding
The Polish supervisory authority ordered the controller to provide the data subject with information on the marketing categories (behavioural profile) attributed to him/her on the basis of cookies, and to indicate what information concerning him/her has been linked to the cookie information.
The supervisory authority pointed out that behavioural profiling involves tailoring advertising to topics of interest to the internet user, and this process is based on the internet user's behaviour and then displaying advertising on topics to which the user spends a large amount of time while surfing the internet. The collection of information about an internet user is inextricably linked to profiling, the key aim of which is to match relevant advertising to a specific person, based on inferences about that person's expected characteristics and needs.
The supervisory authority pointed out that the controller creates a state of uncertainty for the data subject by failing to take a uniform, transparent and reliable view of the content of the data being processed, in particular what marketing categories (behavioural profile) have been attributed to the data subject on the basis of cookies and with what other information about a specific natural person the information resulting from those cookies has been combined. The information provided must be clear, understandable and sufficiently precise to enable the user to understand the functioning of the cookies that are used.
The supervisory authority considered that the controller did not provide the data subject with complete information pursuant to Article 15(1) GDPR. Indeed, the controller's response lacked information on the marketing categories (behavioural profile) that were assigned to the data subject on the basis of the cookies and with which other information about her the information resulting from the cookies was combined.
Comment
The decision has not yet been published on the website of the Data Protection Authority, but has been made available on the website of the law firm in anonymised form. Due to the PDF format (scan) the translation requires a lot of time and will therefore be made available at a later date.
Further Resources
https://panoptykon.org/uodo-mamy-prawo-poznac-swoj-profil-marketingowy
English Machine Translation of the Decision
The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.
& # 13; We encourage you to pay attention to the decision of the President of the Personal Data Protection Office (ZSPR.440.331.2019.PRPAM), pursuant to which the President ordered that the administrator be provided with information about the so-called behavioral profile. In the decision, the President confirmed that the information on "marketing categories" assigned on the basis of cookies, as well as information combined with data resulting from cookies, constitute personal data and are subject to disclosure pursuant to Art. 15 GDPR. The decision is available at the link below. ZSPR.440.331.2019.PR.PAM - anonymised decision & # 13;
