HmbBfDI (Hamburg) - Anweisung zur Erteilung einer Auskunft
| HmbBfDI - Anweisung zur Erteilung einer Auskunft | |
|---|---|
 | |
| Authority: | HmbBfDI (Hamburg) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15(1) GDPR Article 15(3) GDPR Article 58(2)(c) GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Anweisung zur Erteilung einer Auskunft |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | German |
| Original Source: | Hamburg Data Protection Authority (in DE) |
| Initial Contributor: | CBMPN |
Debt collection agency was required by the Hamburg DPA to comply with access requests under the GDPR.
English Summary
Facts
A complaint was filed with the Hamburg Data Protection Authority (HmbBfDI) regarding a debt collection agency's failure to respond to a debtor’s request for access to their data and a copy of their personal information under Article 15(1) and (3) GDPR. Upon inquiry, the agency argued that, as a legal service provider under the Legal Services Act (RDG), it was neither obligated to provide such information nor required to inform the data subject of a rejection. The agency claimed that its role was comparable to that of lawyers and that it was bound by professional secrecy.
The HmbBfDI disagreed with this interpretation, clarifying that lawyers providing debt collection services are generally required to comply with access requests under the GDPR. Despite multiple warnings, the controller refused to change its stance.
Holding
The HmbBfDI issued an order under Article 58(2)(c) GDPR, instructing the agency to provide the data subject with both the requested data access and a copy of the personal data, and to confirm compliance with the authority. The order included a two-week deadline with the threat of a coercive fine.
The controller initially contacted the data subject with general information but did not provide the specific details required under Article 15(1) GDPR nor a data copy under Article 15(3) GDPR. The agency also failed to report compliance to the HmbBfDI. As a result, the HmbBfDI will now enforce the coercive fine and may issue additional penalties if compliance is not achieved.
Comment
This case highlights the obligation of debt collection agencies to comply with GDPR access requests, even when they argue professional secrecy. The HmbBfDI’s enforcement action demonstrates the authority’s commitment to ensuring data subject rights are upheld.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
The HmbBfDI received a complaint according to which a debt collection service provider had not responded to a debtor's request for information and a copy of data in accordance with Art. 15 (1) and (3) GDPR. The HmbBfDI then contacted the debt collection service provider. As part of the audit, the debt collection service provider stated that it was of the opinion that, as a legal service provider under the Legal Services Act (RDG), it was neither obliged to provide information nor to inform those affected that their applications had been rejected. In its opinion, its work was comparable to that of lawyers. Like them, it would therefore be subject to a duty of confidentiality in the sense of client secrecy. The HmbBfDI does not share this opinion. Lawyers are generally obliged to provide information when they undertake debt collection services. The debt collection service provider nevertheless stuck to its position despite corresponding instructions from the HmbBfDI. The HmbBfDI then issued an instruction in accordance with Art. 58 (2) lit. c) GDPR and requested the debt collection service provider to provide the complainant with information in accordance with Art. 15 Para. 1 GDPR and to provide a copy of the data in accordance with Art. 15 Para. 3 GDPR and to notify the HmbBfDI of this implementation. In the event of non-implementation of the measure within 2 weeks, a penalty was threatened. This measure was initially unsuccessful. Although the debt collection service provider contacted the complainant after the instruction was issued and provided general information, there was neither specific information with the information provided for in Art. 15 Para. 1 GDPR nor was a copy of the data sent in accordance with Art. 15 Para. 3 GDPR. The HmbBfDI was also not notified of this. The HmbBfDI will now enforce the threatened penalty. If the information and the copy of the data are not provided, the HmbBfDI can again threaten and enforce a penalty.
