In its decision of June 1, 2021, the data protection authority addressed the legality of collecting foreign traffic fines through collection agencies instead of through the route standardized in the EU-VStVG.
In 2018, the complainant had been “flashed” while speeding on an Italian highway. The Province of Pisa then sent the Austrian authorities a letter called “Protocol”, which requested the complainant to pay an administrative fine. The Austrian authority sent the letter to the complainant in accordance with international law, but the complainant refused to pay.
Thereupon, the Province of Pisa, through an Italian company and a German collection agency, commissioned an Austrian collection agency, the respondent. The latter sent several reminders to the complainant. In doing so, the respondent necessarily processed the complainant’s personal data.
This was done unlawfully and violated the complainant’s right to confidentiality, as the respondent could not rely on any justification under Article 6 GDPR: Due to the fact that the (Union) legislator has standardized a certain procedure for the collection of foreign administrative fines, namely by way of the national enforcement authorities, the data processing by the respondent as a debt collection agency cannot be justified by other permissible grounds of Art. 6 GDPR, in particular, there can therefore also be no overriding of interests of the respondent or third parties within the meaning of Art. 6 (2) GDPR. 1 lit. f GDPR come.
Since the respondent unlawfully processed the complainant’s personal data, it should have been held liable under Art. 17 para. 1 lit. d GDPR must comply with the complainant’s request for deletion of his or her personal data. By refusing to delete, it also violated the complainant’s right to deletion.
The decision is legally binding.