Germany

Private individual

—

GDPR enforcement action by Data Protection Authority of Brandenburg on 2021.

Case details

Authority: Data Protection Authority of Brandenburg
Date: 2021
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The DPA from Brandenburg imposed a three-digit fine on a company employee. The individual had sent an Excel spreadsheet with employee data of 56 employees to her private e-mail address from her official computer, although this was not necessary for her official activities. For this reason, the DPA determined that the employee had unlawfully transferred the other employees' data. The spreadsheet included, in addition to the full names of the employees, an overview of vacation days already taken and remaining, sick days accrued, wage data, overtime worked and social security contributions.

Open original source Links to the regulator's original publication or another source.