ESPAK AS
- Complaint filed
- 22.04.2026
- Decision
- 29.06.2026
- Time to decision
- 68 days
- Decision number
2.1-1/26/593-1220-6- GDPR articles
- 15, 77
2c4fed5d6e862878f4e01f772fb899d4ba21a4109381a0989859514c88c248cbThe document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- Art. 57(1)(f) — handled "to the appropriate extent"
- the GDPR does not oblige issuing an order
- "we take into account that the person can resolve it themselves"
- no public interest / an individual request
What was in the complaint
Espak AS is a retail chain of building materials with a loyalty-card programme. The complainant is a customer; the card was issued against an ID document in the shop, so the fact of processing is indisputable.
22 February 2026 — an Art. 15 request to info@espak.ee: confirmation of processing (purchase history, profile, segments), a list of third parties, transfers outside the EU, the logic of profiling.
22 March — a reminder from a new address, with proof of the first request attached.
24 March — 30 days expired. No reply at all — neither to the request nor to the reminder.
Article: 12(3).
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); “we take into account what possibilities the person themselves has to resolve the situation”.
Analysis
The simplest of the cases: an Estonian company, AKI’s full jurisdiction, an indisputable fact of processing (the card was issued against a passport), and complete silence in response to a lawful request. Art. 12(3) was breached obviously.
The regulator closed the case all the same. It is telling precisely because of its simplicity: here there is no disputed reading of a HAR, no unreachable American — there is a local company that simply did not reply. And supervision did not intervene.