Non-compliance to the GDPR
It was immediately clear to the Authority (as it is to anyone who chose to visit the website today) that there is no effective method of raising a subject access request to this company. Their privacy policy is minimal in the extreme, and factually incorrect in the information it does provide; it claims that it does not “redistribute information to any third parties”, but their Twitter feed (5) is filled with the information of EU data subjects trying to find individuals, along with the names of those individuals whom they are trying to locate. It must be assumed that, because the forgotten individuals aren’t in contact with the person seeking them, they would not have consented to the use of their information, and no other legal basis for the processing of those names seems to exist.
There is a webform to request the removal of data, but it is conditional on providing an email address which contains the person’s name, so if they have a more generic email address (e.g. [email protected]), that request would likely be rejected. Because the individual themselves would not have provided any information when their data was added to the site (the source of the data listed remains vague, and presumably the subject of further enforcement action to come), there seems to be no adequate way of confirming the identity of a data subject who is requesting deletion of their data – and any individual who did choose to have their data included on the site could potentially have it taken down by someone else pretending to be the data subject (removing such data – when doing so is against the wishes of the data subject to which it related – would also be a violation of GDPR).
The authorities were easily able to conclude that GDPR applied to the processing of the personal data of EU-based individuals listed on the site: a service is being provided to EU-based individuals to assist them to find other individuals, therefore causing the website’s processing of that data to be subject to regulation under GDPR (Article 3(2)(a)). The (brief) responses they received from the website advised that they had no EU establishment or Representative, and nothing in the authorities’ investigations indicated otherwise.
Accordingly, with GDPR applying to the personal data processing, and no EU establishment, the obligation under GDPR Article 27 – that the website should appoint a Representative in the EU – applies.
Out of interest, the authorities concluded that the website is acting a controller and not processor of this information – again, this appears quite clear from the website itself (and their Twitter feed), as they seem to choose the manner in which the personal data is being processed, publishing it at their discretion.
The authorities were also able to discount the applicability of the various exclusions: the website does not appear to be connected to a public authority (Article 27(2)(b)), nor did the processing appear to be outside the scope of EU law (e.g. relating to national security etc). There was some helpful clarification of the Dutch Authority’s interpretation of the “occasional processing” exemption in Article 27(2)(a). The Authority found that the processing of this personal data was not incidental to the website’s operation so, even if there was only a small volume of EU personal data being processed (which appears not to be the case), the occasional exemption would not apply because the process was a usual part of the website’s operation. This interpretation of “occasional” is in line with how that term is interpreted regarding the need to appoint a Data Protection Officer, and this ruling serves as confirmation that the same interpretation should apply to the exclusion from the Representative requirement.
Therefore, the company is required by GDPR to appoint a Representative and clearly (including by their own admission) they have not done so.
The full decision also sets out some of the thinking behind the scale of the fine. To summarise, in the absence of any mitigating factors, the standard level of fine for this type of transgression (as set out in the Dutch authorities Fining Policy Rules 2019 (6)), taking into account the relevant factors, set the fine at €525,000 (noting that the maximum possible fine is the larger of €10m or 2% global revenue, in line with GDPR Article 83).
