Denmark

Gyldendal A/S

134,000 €

GDPR enforcement action by Danish Data Protection Authority (Datatilsynet) on 2022-06-22.

Rank · Sector

#103

of 369 in Media, Telecoms and Broadcasting

Rank · Denmark

of 29

Rank · All fines

#424

of 3,050

Case details

Authority: Danish Data Protection Authority (Datatilsynet)
Date: 2022-06-22
Controller / Processor: Gyldendal A/S
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) e) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Danish DPA has fined publisher Gyldendal A/S EUR 134,000.

During its investigation, the DPA found that the company had kept the data of approximately 685,000 unsubscribed members of Gyldendal's book clubs longer than necessary.

Instead of deleting the data of the deregistered book club members, Gyldendal kept the data in a database. The data of approximately 395,000 of the former members affected were kept for more than 10 years. In addition, the DPA found that Gyldendal did not have a procedure or guidelines for data deletion.

Open original source Links to the regulator's original publication or another source.