21. Dezember 2018
Kavalleriestraße 2-4, 40213 Düsseldorf
Decision pursuant to Article 60 Paragraph 7 GDPR
(IMI case no. 49178/IMI entry no. 50869)
against the enterprise
because of open data origin in connection with an advertising
On 04 October 2018 I submitted a draft decision concerning the above
mentioned complaint for your opinion. Since within the four-week-period
pursuant to Article 60 para. 4 GDPR there wasn’t any objection, I hereby
adopt the following decision pursuant to Article 60 para. 7 GDPR.
stated its position concerning the
complaint in a letter on 24 August 2018.
According to this statement the
details from the directory of the Balearic Tourism Authority for
advertising purposes for customer acquisition.
As an allowing legal basis Article 6 para. 1 lit. f GDPR could be
considered. According to this processing is lawful if it is necessary for
the purposes of the legitimate interests pursued by the controller or by a
third party, except where such interests are overridden by the interests
or fundamental rights and freedoms of the data subject which require
protection of personal data, in particular where the data subject is a
In recital 47 (last sentence) it is pointed out that processing of personal
data for direct marketing purposes may be regarded as carried out for a
But this is not to be understood as privileged treatment. The balancing
of interest remains an obligation. Therefore it is questionable whether
the fundamental rights and freedoms of the data subject don’t prevail.
The interest of the data subject is to be assessed as low, if data have
been made public officially and are available for everyone. Furthermore,
in the frame of the assessment, nature, content and significance of the
data involved are to be compared with the purpose of the data
processing. These are, in the present case, address details and the
combination of information: the address of the holiday home and the
name of the owner.
According to the present case legitimate interests of the petitioner were
not presented and are not recognizable.
On the whole Article 6 para. 1 lit. f GDPR can be considered as an
allowing legal basis.
The advertising flyers were dispatched before the GDPR came into force
and therefore at a point of time when the obligation to inform according
to Article 13 and 14 GDPR did not exist. But according to the now
applicable law Article 14 par. 2 lit. f GDPR the data subject would have
to be informed, from which source the personal data originate and, if
necessary, whether they come from publicly available sources. The
enterprise is to be informed about this for future advertising mails.
On behalf of the authority