AS Ühisteenused – Court Ruling (Estonia, 2024)

The data subject brought an action against AS Ühisteenused, a company providing parking services ('controller 1'). The company that made a claim against the data subject arising from a contractual penalty in the amount of €79,57 for a car parking violation. According to a debt notice of 29 April 2022 sent to the data subject, the violation occurred on the 17 April 2019 and the penalty was to be paid by 2 May 2019. The data subject sold the car on 27 August 2019, and was not aware of AS Ühisteenused's parking regulations or the alleged violation on 17 April 2019, as they did not personally use the car. On 25 March 2022, AS Ühisteenused and Julianus Inkasso OÜentered, a debt collection company (‘controller 2’) entered into an agency agreement on the basis of which and Julianus Inkasso OÜ was authorized to represent AS Ühisteenused in the recovery of the debt owed by the data subject. As two controllers jointly determined the purposes and means of processing, they became joint controllers under Article 26 GDPR. As a result, the data subject’s debt was published on the website taust.ee (eng translation: background.ee) by Julianus Inkasso OÜ. On 29 May 2022, the data subject requested both controllers to stop processing their personal data and delete them from the website. According to [https://www.riigiteataja.ee/akt/106072023098 §146 of the Estonian Civil Code], the expiry date for the request arising from a violation of the law is three years. Since the penalty was to be paid by 2 May 2019, the three-year deadline expired on 3 May 2022 and the claim was therefore time-barred. Therefore, the data subject asked a court to order the controller 2 to delete the debt information linked to them and to pay €270 by way of damages for per-litigation legal costs. In its reply, controller 1 stated that they have a right to disclose this type of data. In particular, under [https://www.riigiteataja.ee/akt/104012019011 § 10(2)(5) of the Estonian Data Protection Act], the transfer of personal data to a third party in connection with debt-relationship is permitted for a period of 5 years after the breach of an obligation. Additionally, according to [https://www.riigiteataja.ee/akt/122032024007 § 146(4) Estonian Civil Procedure Code], the expiry date for the claims is 10 years if the person responsible violates his or her duties intentionally. In this case, the debt notice was published 3 years after the breach occurred. The data subject argued that the controller 1 had no legal basis to process data subject’s personal data because the limitation period had expired. Therefore, it is neither lawful nor fair to disclose the claimant's personal data after the claim itself was time-barred. The first instance court gave its decision, which was appealed. The decision adopted by the first instance court was in part confirmed by the appeal court as follows: The court found that the controller's claim concerning the debt was time-barred and ordered controller 1 to pay related costs of the proceedings. On the other hand, and as far as the GDPR is concerned, the court ordered controller 2 to delete the data subject’s data from its website. Regarding the publication of the data subject’s debt on the website taust.ee, the court found that under Article 10(1) of the Estonian Data Protection Act, such processing is permitted for the purpose of assessing the creditworthiness of the data subject or for any similar purpose. However, the controller must verify the accuracy of the transferred data and the legal basis for such transfer. In addition, the Estonian law provides that transfer of this data to a third party cannot be permitted if such transfer would cause excessive damage to the rights or freedoms of the data subject, nor if more than five years have elapsed since the breach of the obligation. This constitutes a legitimate interest under Article 6(1)(f) GDPR. Although the 5-years period had not elapsed, yet, the court performed a balance between the interest of the controllers and the fundamental rights of the data subject. The court took the view that the controller 1 did not take active steps to obtain the debt within the limitation period in a sufficiently justified and timely manner to allow the disclosure of the data subject's debt after three years. The court stated that for a small debt of €79.57, if the creditor finds legal action too costly or complex, or fails to act within the limitation period, the creditor's interests in processing the data under Article 6(1)(f) GDPR do not outweigh the data subject’s interest in having the data deleted. The controllers should have complied with the data subject’s request to delete their personal data. All in all, the court found a breach of Article 6(1)(f) GDPR as the data subject personal data related to its time-barred debt were unlawfully disclosed. The controller 1 is ordered to pay related costs of the processing. The court also ordered the controller 2 to delete the data concerning the data subject’s debt from its website and pay the data subject €200 for damages incurred from per-litigation costs.