In the decision of 3.1.2020, GZ: DSBD124.1090/0005-DSB/2019, the DPO had to deal with the processing of personal data in connection with measures related to an unpaid transport service. The complainant had used a transport service provided by the respondent, who operates a cab company. Since the complainant did not have enough cash to pay, the respondent took a photo of the complainant’s driver’s license and ATM card without the complainant’s consent, forwarding the driver’s license photo to at least a third person (an acquaintance of the respondent) via “Whatsapp”.
The data protection authority upheld the complaint and found a violation of the complainant’s right to confidentiality within the meaning of data protection law. § 1 DSG
because neither the data collection (taking photos) nor the data transfer (forwarding via Whatsapp) was lawful. In this regard, the respondent could neither rely on a vital interest of the person concerned nor on his consent. Processing in the overriding legitimate interest of the respondent was also to be denied, since the photographing of the driver’s license and the ATM card as well as the forwarding of the driver’s license photo to an acquaintance of the respondent was disproportionate and in violation of the principle of data minimization as defined by the data protection law. Art. 5 par. 1 lit. c has been violated.
This decision is not legally binding.