Update 'ABIS GmbH' (community contribution)

[datenanfragen-community-edits]

This suggestion was submitted through the website.

Edit

[mal-tee]

When I made a request via email in 2020-05 the wrote back "Gerne beantworten wir Ihnen Ihre Anfrage. Bitte haben Sie jedoch Verständnis dafür, dass wir eine Auskunft gem. Art. 15 DS-GVO nur dann erteilen können, wenn uns die im beigefügten Schreiben genannten Angaben in schriftlicher Form vorliegen.", so I guess fax makes sense?

[mal-tee]

I can also confirm the comment on the company that they want an "eigenhändige Unterschrift", so i guess we should make a comment in the record?

[baltpeter]

This seems to depend on whether they have data on you. I got the (written) confirmation that they don't have any data on me by simply sending an email (in September 2020), without having to submit any additional requirements.

As such, I don't think changing the record to 'fax' is a good idea. The signature isn't necessary in all cases, most users don't have access to a fax machine and according to the comment they also accept the signature via email.
I think it's best if we simply add a comment explaining that to the record. Users probably won't know beforehand whether Abis has data on them, so it doesn't make sense to voluntarily submit a signature in all cases.

[baltpeter]

Only slightly related: It would be great to have a supervisory authority decide whether the practice of requiring the signature is even lawful. The GDPR doesn't specify any "Formerfordernisse" and a signature obviously cannot be used for identification purposes.

Unfortunately I cannot submit a complaint as they didn't want a signature for my request. :D

[rugk]

Ok, I'll do.

[rugk]

Sent. I'll keep you up-to-date.

[mal-tee]

Great! Thanks.

[mal-tee]

So, should we update the record like this for the time being?

[mal-tee]

Thanks!

Should we create an issue for the discussion regarding @rugk 's complaint or do we just use this PR? :D

[rugk]

Problem solved.

LDI Hessen:

Die ABIS GmbH hat mir nunmehr bestätigt, dass der Prozess zur Auskunftserteilung den datenschutzrechtlichen Maßgaben angepasst worden ist.

Die Betroffenenrechte erfordern keine bestimmte Form, insbesondere keine Unterschrift der betroffenen Person. Eine eindeutige Identifikation des Betroffenen ist mit einer Unterschrift auch gar nicht möglich. Nach Art. 12 Abs. 6 DS-GVO kann der Verantwortliche lediglich dann zusätzliche Informationen anfordern, welche zur Bestätigung der Identität der betroffenen Person erforderlich sind, wenn er begründete Zweifel an der Identität der natürlichen Person hat. Ein voraussetzungsloses Anfordern weiterer Daten ist damit nicht vereinbar. Eine Unterschrift der betroffenen Person wird zukünftig von der ABIS GmbH nicht mehr verlangt.

Die Erteilung von Auskunftsersuchen muss zudem auf verschiedenen Kommunikationskanälen geschehen. Entsprechend erfolgt eine Auskunftserteilung durch die ABIS GmbH künftig nicht mehr nur mittels Briefpost.

Ich bedanke mich für Ihren Hinweis auf das nicht datenschutzkonforme Verhalten der ABIS GmbH, welcher zu einer Optimierung des Datenschutzes beigetragen hat, und verbleibe[…]

[mal-tee]

Wow, that is great!

[baltpeter]

@rugk I'm a little late to the party but that is indeed great. Thanks for submitting the complaint!

I think it would be good to have a blog post on this for our website (this PR is kind of hard to find). That post could serve two important purposes: a) document that requiring signatures for requests is not OK and b) be an awesome (and unfortunately quite rare, thus far) example of a successful complaint that actually changed the situation for the better for everyone.

Would you be OK with sharing a redacted copy of your correspondence with the LDI Hessen with me? That would make writing the post a lot easier. You can reach me via email (PGP key) or Matrix).

But if you don't want that, that's obviously totally OK as well.

[rugk]

Done. (ID: GqLAkqcDekj,iH6,3oCx)

[rugk]

Or, of course you can FOI-request that communication from the LfDI Hessen.
Agency reference: AZ 90.20.77:0245

[baltpeter]

Thank you! I have opened #524 for the post.

Or, of course you can FOI-request that communication from the LfDI Hessen.

Good point! As someone from Lower Saxony that isn't a right I am used to having. :D

[mal-tee]

https://www.datenanfragen.de/blog/abis-unterschrift-dsgvo-anfragen/
The article is live 🥳