AKI (Estonia) - 2.1.-6/20/19

AKI - 2.1.-6/20/19
Authority:	AKI (Estonia)
Jurisdiction:	Estonia
Relevant Law:	Article 6 GDPR Article 58(1)(a) GDPR Article 56(1) Personal Data Protection Act Article 56(2) subsection 8 Personal Data Protection Act Article 60(2) Personal Data Protection Act
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	30.04.2020
Fine:	500 EUR
Parties:	Apartment association Outokumpu 19
National Case Number/Name:	2.1.-6/20/19
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Estonian
Original Source:	AKI (in ET)
Initial Contributor:	n/a

The Estonian DPA (AKI) ordered an apartment association to cease the disclosure of photos depicting members of the association in places where third parties had access, without obtaining prior consent. It also imposed € 500 fine as injunction.

English Summary

Facts

A member of the cooperative complained before the DPA about photographs of himself and of other members of the cooperative that had been published in the stairwell of the building without prior consent.

Holding

The DPA found that for the publication of the photos a valid legal basis would be needed according to Article 6 GDPR. Consent would be the only proper legal basis here if it meets all the requirements to be valid. The DPA found that prior consent had not been obtained and ordered an injunction. It ordered the cooperative to pay 500 euro and cease the disclosure of the photos immediately.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Estonian original. Please refer to the Estonian original for more details.

Injunction-WITHOUT personal data in case
 No 2.1.-6/20/19 
Injunction
Date and place of injunction
Data Protection Inspectorate 30.04.2020, Tallinn 
Apartment association Outokumpu 19
address: Outokumpu tn 19-47, 30327 Kohtla-Järve
e-mail address:outokumpu19@hot.eemailto:outokumpu19@hot.ee
Member of the Management Board of Personal Data Processer	
person responsible
RESOLUTION
Pursuant to the clause 56 (1), (2) subsection 8, 58 subsection 1 of the Personal Data Protection Act and Article 58(1)(a) of the General Data Protection Regulation and subject to the clause e of the same subsection, the inspection shall make the following mandatory requirements:
Discontinue any further disclosure of personal data without consent in an area accessible to third parties, including staircases of the building no later than 13.05.2020.
Please notify the Data Protection Inspectorate of the fulfilment of the injunction no later than by that deadline at the address info@aki.ee. mailto:info@aki.ee
WITHDRAWAL PROCEDURES:
This injunction may be challenged within 30 days by either:
-	an appeal to the Data Protection Inspectorate pursuant to the Administrative Procedure Act; or
-	an appeal to Tallinn Administrative Court according to the Code of Administrative Court (in this case the appeal can no longer be examined in the same case).
Contestation of an injunction shall not suspend the obligation to comply with it or the measures necessary to comply with it.
PENALTY MONEY WARNING:
If an injunction is not complied with by the specified deadline, the Data Protection Inspectorate shall assign an injunction to the addressee on the basis of subsection 60 (2) of the Personal Data Protection Act:
Penalty fee EUR 500.
Penalty payments can be imposed repeatedly – until the precept is fulfilled. If the addressee does not pay a penalty payment, it shall be forwarded to the bailiff for the commencement of enforcement proceedings. In this case, the penalty payment will be added to the bailiff’s fees and other enforcement costs.
Tatari 39, Tallinn 10134/627 4135/ info@aki.ee / /Registry code 70004235http://www.aki.ee/ 
FACTS OF FACT:16.04.2020. A member of the cooperative complained to the Inspectorate with photographs that his personal data as well as those of the other members of the cooperative had been published in the stairwell of the building without prior consent (the number, name, signature of the apartment). 
16.04.2020. Inspection sent a proposal to the processor:
To stop any further disclosure of the personal data of the members of the cooperative to third parties, including in public spaces (building staircases) and send a confirmation of this to the inspection address at info@aki.ee no later than 23.04.2020.
24.04.2020. In a new complaint, the member of the cooperative filed new photos (a list of signatures, according to the apartment number, who agrees to turn off heating).
STATEMENT BY THE PROCESSOR OF PERSONAL DATA:
The processor has not exercised his or her right to submit objections and opinions and shall disclose personal data on the stairwells of the building.
GROUNDS FOR THE DATA PROTECTION INSPECTORATE:
The Inspectorate explains that any processing of personal gifts requires a basis arising from Article 6 of the General Data Protection Regulation. In this case, only the prior consent of the persons can be given.
We explain that the general rule when publishing the information of the members of the housing association is that it is allowed in the internal relationship (between the members of the association) and that in foreign relations (to third parties) the consent of persons is required. Please note that the disclosure of personal data in the stairwell and other places accessible to third parties or on the Internet is contrary to the law, as the data is also visible to third parties. It is also prohibited to publish only the apartment number, as the names of the owners can be identified either from the land register or from other public registers.
We also recommend that you read the instructions for publishing the data of the members of the apartment association.The principles of the guide apply to the disclosure of any personal data, not only to data relating to debt information.
In view of the above, the injunction obliges the disclosure of future members’ data in a place where third parties have access to the disclosure. Unless each person consents to the disclosure of his/her personal data in a format that allows written reproduction, e.g. in the stairwell of the building (including an agreement on the composition of the data).In addition, account must be taken of the fact that any person can withdraw his consent at any time. Consent must be given of free will and an alternative must be offered to those who do not consent to the disclosure of personal data in this way.
/signed digitally/
senior inspector under the authority of the Director-General