DPA case DSB-D205.023 – Dismissed (Austria, 2020)

The complainant went to a post office to receive a letter addressed to him. From the post office employee, he was informed that the letter had not been delivered to him and that it had been left at that post office and that a notice had been left to the complainant (the so-called “yellow slip”). This was a non-official, recomanded (with a take-over certificate) registered letter. The post office clerk asked the complainant to show his identity document with a photo in order to take the letter. The complainant showed his identity card. Subsequently, the post office employee electronically (using a scanning device) recorded identity card data: type of ID card, ID card number, issuing authority, date of birth and the corresponding name. It was stored for 6 months. After the retention period expired, the data in question were deleted. However, no copy of the ID document itself was made. The complainant alleged that the post office infringed confidentiality obligations by making a copy of his identity card. The complainant pointed out that even the general terms and conditions of the Post Office, in the event of doubts as to the identity of a person, refer to a presentation of a document and not to data collection. That is why he lodged a complaint with the supervisory authority. Has the complainant's right to privacy been infringed by the action of a postal worker to electronically register and save the complainant's identity card when he receives his registered letter at the post office? The DPA rejected the complaint. It held that making by the post office a copy of a recipient's identity card does not infringe complainant's right to privacy and the post office has a legitimate interest in processing the personal data contained in the identity document to safeguard or defend its legal claims.