Answer to Request

FOR DATA PRIVACY AND FREEDOM OF INFORMATION ASUTUSESISESEKS KASUTAMISEKS Teabevaldaja: Andmekaitse Inspektsioon Märge tehtud: Juurdepääsupiirang kehtib kuni: Alus: Mr Idir Laurent Khiar Yours: 21.02.2022 nr DPD Eesti AS Ours: 04.03.2022 nr 2.1.- 5/22/586 [email protected] Answer to Request We received your request regarding qualifying as controller when providing postal services. Below you will find an answer to your question. 1. Does a company which processes personal data for the purpose of performing postal services (Postal Act §2), and on which the Postal Act assigns the right to collect and process non-sensitive personal data regarding senders and addressees for the provision of postal services (§34), and on which that legal act assigns the obligation to maintain postal secrecy (§33), qualify as a controller in the meaning of the GDPR? In short, the postal service provider qualifies as a controller only regarding the data it holds to arrange a delivery or tracking for example, such as individual senders and recipients names and addresses and in respect of its own staff records and so forth. Everything that is in the package, the postal service provider by default do not know about, and cannot therefore act as a controller. Let us take an example - A postal service is contracted by an organisation or private person to deliver a package containing personal data to organisations or private persons. The courier service is in physical possession of the package but may not open it to access any personal data or other content. A postal service will not generally process personal data, even if it does physically hold the personal data contained in a letter sent using its services. Processing personal data, including holding it, implies a degree of access to or ability to control or use the data itself, not just physical possession of the letters or parcels that contain the data. The term ‘holding’, as used in the definition of ‘processing’, implies considerably more than simply being in possession of a physical object that contains personal data. This means that the postal service is neither a data controller nor a data processor for the clients that use its services because it is a mere conduit between the sender of the package and its recipient, it does not exercise any control over the purpose for which the personal data in Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee Registrikood 70004235 the items of package entrusted to it is used and it has no control over the content of the personal data entrusted to it. This makes sense in practice because it would be unreasonable to expect a postal service that has no control over the content of the package items it delivers to comply with the data protection principles. For example it would not be able to ensure that personal data in its possession is accurate, up to date or held only for so long as it necessary. It cannot have data protection responsibility for personal data contained in an item of package. It is merely responsible for the security of the letter or parcel in a physical sense. The fact that the postal service does not act as a controller for the package it has been asked to deliver – even if the content is personal data - means that the EDPI cannot take any action against the postal service. Also the fact that the postal service is not a data processor means there is no need for clients using its services to put a data controller – data processor contract in place. The data controller that chooses to use a postal service to transfer personal data is the party responsible for the data. If a postal service loses a parcel containing highly sensitive personal data, it is the data controller that sent the data that will be responsible for the loss. It was the data controller that chose to use the postal service. If it was vital that the personal data was delivered securely, the data controller should have used secure delivery rather than an ordinary postal service. However, as stated above, the postal service will be a data controller in its own right in respect of any data it holds to arrange delivery or tracking for example, such as individual senders’ and recipients’ names and addresses and in respect of its own staff records and so forth. Best regards Mehis Lõhmus lawyer authorised by Director General 2 (2)