Poland

School in Gdansk (Danzig) (fine imposed against town of Gdansk)

0 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2020-03-04.

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2020-03-04
Controller / Processor: School in Gdansk (Danzig) (fine imposed against town of Gdansk)
Sector: Public Sector and Education
Quoted Articles: Art. 5 GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

Original summary: A school in Gdansk used biometric fingerprint scanners to authenticate students for the payment process in the school canteen. Although the parents had given their written consent to such data processing, the data protection authority considered the processing of the student data to be unlawful, as the consent to data processing was not given voluntarily.
Update: Update: On August 7, 2020, the Provincial Administrative Court in Warsaw overturned the decision of the Polish DPA imposing a fine of EUR 4,600.

Open original source Links to the regulator's original publication or another source.