Trionic Sverige AB – Complaint Upheld (Sweden, 2022)

The data subject ordered a product from the German website of Trionic, a company selling wheelchairs among other products. According to the data subject, the controller then sent a copy of his order confirmation to the domain provider of the data subject's email provider. The data subject communicated his dissatisfaction about this practice to the controller. The data subject also complained about the fact that the controller was sharing personal data with another company, despite the fact that this was not mentioned in the privacy policy. The data subject later cancelled the order. The controller clarified its several processing operations and the corresponding legal bases. First, the controller suspected at first that the data subject had provided an incorrect personal e-mail address for this order. When the controller tried to contact the data subject with the provided telephone number, this did not work. It turned out that the data subject had provided a fax number instead of a telephone number. Because there was no other way to contact the data subject, the controller decided to send the order confirmation to the 'info' e-mail address of the data subject's e-mail domain. Besides the fact that the controller claimed that this was the only way to contact the data subject, the controller also stated that it was legally obligated to do so pursuant to Article 5(1)(d) GDPR. The controller did not explicitly mention Article 6(1)(c) GDPR, but it did mention that it was using the legal bases of 'legal obligation'. Second, the controller allowed its customers to pay with invoice in the German market. However, the controller had experienced before that these invoices were not paid. To prevent this from happening again, the controller shared the data subject's personal data with its processor, providing fraud control services. The controller's legal basis for this processing was Article 6(1)(f) GDPR, for the controller's legitimate interest to prevent fraud. It also provided its assessment why its interests outweighed the interests of the data subject. However, the controller merely referred to this processor in its privacy policy as external resources', without any further explanation. On an unspecified date, the data subject filed a complaint at a German DPA (not specified which German DPA). On another unspecified date, this German DPA then transferred the decision to the Swedish DPA, which was the lead supervisory authority in this decision. The concerned supervisory authorities were the DPA's of Denmark, Norway and a German DPA. First, with regard to the sending of the e-mail to the info address of the data subject's email domain, the DPA acknowledged that the controller had to comply with Article 5(1)(d) GDPR. However, this provision also only permitted the processing of personal data that was strictly necessary. In this case, the DPA held that there were less coercive measures which the controller could have taken, such as sending a fax to the data subject, which would have been possible. The processing was therefore not necessary. The DPA determined that Article 6(1)(c) GDPR and no other legal basis could be used for this processing. Therefore, the controller violated Article 6(1)GDPR. Second, the DPA held that the controller could rely on Article 6(1)(f) GDPR for sharing personal data with its processor for anti-fraud purposes. The DPA assessed the following three criteria of the assessment of legitimate interest. First, the DPA noted that the interest of preventing fraud was justified at the time of processing, given the fact that it was an actual interest and not just hypothetical. Second, the DPA determined that sharing this data with its processor was also necessary for the controller to prevent fraud, because it could not fulfil this purpose in an equally effective manner. Also, the disclosure of this data was not too extensive or privacy-sensitive. Third, based on several factors, the DPA determined that the interests of the data subject did not outweigh the legitimate interests of the controller. The DPA considered that the controller's interest to prevent fraud weighted heavily since the data subject's order was paid with a credit purchase. This interest had to be compared with the data subject's interest in preventing their data from being processed. The DPA considered in this regard that the data subject could reasonably expect the processing by the controller when making a credit purchase on invoice, despite the minor deficiencies of the privacy policy (see below). The DPA also considered that the processing did not appear to be severely privacy invasive and that the data itself was not really privacy-sensitive. However, the DPA did determine a violation of Article 13(1)(e) GDPR because the processor was only mentioned in the controller's privacy policy as one of it's external resources' for fraud prevention. The DPA held that this description was not specific enough. The Swedish DPA determined that this was a minor infringement and issued a reprimand pursuant to Article 58(2)(b) GDPR.