Germany

Restaurant operator

—

GDPR enforcement action by Data Protection Authority of Berlin on 2022.

Case details

Authority: Data Protection Authority of Berlin
Date: 2022
Controller / Processor: Restaurant operator
Sector: Accomodation and Hospitality
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The DPA of Berlin has imposed a fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with their personal data for the purpose of contact tracing as required by law. However, the controller unlawfully used the data to send promotional messages to the data subjects.

Open original source Links to the regulator's original publication or another source.