Iceland

Hörpu tónlistar- og ráðstefnuhúss ohf.

7,000 €

GDPR enforcement action by Icelandic data protection authority ('Persónuvernd') on 2022-03-08.

Rank · Sector

#255

of 597 in Industry and Commerce

Rank · Iceland

#22

of 22

Rank · All fines

#1,559

of 3,050

Case details

Authority: Icelandic data protection authority ('Persónuvernd')
Date: 2022-03-08
Controller / Processor: Hörpu tónlistar- og ráðstefnuhúss ohf.
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) c) GDPR, Art. 6 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Icelandic DPA has fined Hörpu tónlistar- og ráðstefnuhúss ohf. EUR 7,000.

The DPA had received a complaint regarding the concert hall's collection of ID number and date of birth information as part of an electronic ticket purchase.

The incident occurred prior to the start of the Covid-19 pandemic, when the registration of personal data for contact tracking in the context of event visits was not yet required.
The DPA concluded that it would not have been necessary to collect the data for issuing a ticket, as it would have been possible to conclude a purchase contract even without this collection. For this reason, the DPA found that the concert hall had violated the principle of data minimization.

Open original source Links to the regulator's original publication or another source.