Germany

Private individual

—

GDPR enforcement action by Data Protection Authority of Brandenburg on 2021.

Case details

Authority: Data Protection Authority of Brandenburg
Date: 2021
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The DPA of Brandenburg has imposed a three-digit fine on a company employee. The employee had forwarded application documents received by his employer from his work e-mail address to his private e-mail address without authorization in order to get suggestions for the design of his own applications. He had not previously anonymized the resumes, so they continued to include all of the applicants' personal and professional data. Since sending the application documents to his private e-mail address was not part of his work duties, the DPA determined that the forwarding was unlawful.

Open original source Links to the regulator's original publication or another source.