Trustpilot – Dismissed (Denmark, 2022)

On 11 May 2019, the data subject bought an unspecified item from the company Asus on EBay, an online market place. Asus is a company that mainly sells consumer electronics, such as smartphones, laptops and accessories. On 3 February 2020, the data subject received an e-mail from noreply.invitation@trustpilot.com. In this email, the data subject was asked to evaluate his buying experience with Asus. On 4 February 2020, the data subject requested access to his personal data by sending an e-mail to Trustpilot using a different e-mail account. Trustpilot replied on 6 February 2020 that it was not able to identify the data subject using this e-mail address. On 8 February 2020, Trustpilot sent the data subject another similar e-mail to the data subject. On 10 February 2020, the data subject filed a complaint at a German DPA (Bavaria DPA), which forwarded the complaint to another German DPA (Beauftragte für Datenschutz und Informationsfreiheit (Berlin DPA). The latter transferred the complaint to the Danish DPA (DPA), which was the lead supervisory authority in this decision (Article 56 GDPR). According to the data subject, Trustpilot was not allowed to process personal data about him. He also stated that Trustpilot had not responded to his access request. Trustpilot stated that it was a processor for other companies in relation to the sending of such emails. Trustpilot based this assessment on the fact that companies decided to use Trustpilots software and also decided whether and when invitations were send out using Trustpilots software. In addition, it were the companies, in this case, Asus, that provided the personal data used for the invitations. Therefore, Trustpilot was the processor. In this decision, a data processing agreement of Trustpilot was also disclosed. It was stated that Trustpilot would assist in any handling of requests from data subjects under Chapter III of the GDPR and, where commercially practicable, under any other Applicable Data Protection L