GI-DEC-DS-129/04


Mr X filed a complaint to the Inspector General in the case of the processing of his data by TFI "A" S.A. (investment funds association ľauthority managing the investment fund in which Mr X participated) by disclosing his data to the Bank, although Mr X objected to the processing of his personal data for marketing purposes.

In the course of the proceedings conducted in this case the Inspector General revealed that Mr X`s personal data were incorrectly entered into the information system by an employee, which caused these data to be transferred to the Bank, which used them for marketing purposes.

Upon checking in the archives of source documents the employee`s mistake was corrected, and the Bank was informed thereof by TFI "A" S.A. The Complainant`s data were not disclosed to any other subjects than the indicated Bank to which the data concerned were transferred once on the basis of the agreement concluded with TFI "A" in order to send the correspondence connected with launch of the funds Online service. As a result of the activities undertaken by TFI "A" S.A. the Bank erased the Complainant`s personal data from all the filing systems, including the archival ones.

As a result of addressing to the President of TFI "A" Management Board by the Inspector General of the request for instituting disciplinary proceedings against persons responsible for incorrect entering into the information system of the information on expressing consent to the processing of his data for marketing purposes by the Complainant, and groundless transfer of the Complainant`s personal data to the Bank for marketing purposes, TFI "A" restored the proper legal state. It was impossible to institute disciplinary proceedings against the guilty employee, because he was not employed at that time. However, TFI "A" undertook a number of technical and organisational activities to prevent similar situations in the future.

The Inspector General for the Protection of Personal Data stated that Mr X`s complaint was justified. However, due to the fact that as a result of the activities undertaken by the Inspector General TFI "A" restored the proper legal state by causing Mr X`s personal data to be erased from the filing system kept by the Bank and undertook a number of measures protecting against similar events in the future, inter alia by introducing a new form containing a legible clause concerning the expression of consent to the processing of data for marketing purposes, the Inspector General for the Protection of Personal Data refused to consider the Complainant`s request.