Germany

Covid-19 test center

1,400 €

GDPR enforcement action by Data Protection Authority of Hamburg on 2022.

Rank · Sector

#243

of 270 in Health Care

Rank · Germany

#93

of 116

Rank · All fines

#2,541

of 3,050

Case details

Authority: Data Protection Authority of Hamburg
Date: 2022
Controller / Processor: Covid-19 test center
Sector: Health Care
Quoted Articles: Art. 6 (1) c) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The DPA from Hamburg has imposed a fine of EUR 1,400 on a Covid-19 test center. The controller intended to fulfill its statutory documentation obligations and scanned the front and back of ID cards of tested persons for this purpose. However, such extensive storage of personal data would not have been necessary to fulfill its documentation obligations. This could and should have been known to the controller.

Open original source Links to the regulator's original publication or another source.