Spain

Company

3,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2022-11-29.

Rank · Sector

#122

of 224 in Not assigned

Rank · Spain

#664

of 1,114

Rank · All fines

#2,198

of 3,223

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2022-11-29
Controller / Processor: Company
Sector: Not assigned
Quoted Articles: Art. 6 GDPR, Art. 13 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 3,000 on a company. The controller had installed a video surveillance system that also recorded the voices of both employees and customers. During its investigation, the DPA found that the controller did not have a valid legal basis for processing the information of the voices as part of the video surveillance. In addition, the DPA found that the controller failed to provide sufficient information about the video surveillance, including information about the processing, the identity of the controller, and the exercise of data subjects' rights.

Open original source Links to the regulator's original publication or another source.