Spain

GSMA Limited

600,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2024-05-31.

Rank · Sector

of 351 in Individuals and Private Associations

Rank · Spain

#38

of 1,075

Rank · All fines

#224

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2024-05-31
Controller / Processor: GSMA Limited
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1), Art. 9 (2) GDPR, Art. 14 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 600,000 on GSMA Limited.
In 2022, GSMA Limited required employees of its suppliers to register on an online platform and upload proof of vaccination against COVID-19. One of the data subjects filed a complaint with the DPA as they considered the data processing to be unlawful.
GSMA referred to a legal obligation and public interest, but could not provide a specific legal basis. The DPA found that less invasive safeguards would have been possible and that the affected workers were not sufficiently informed about the data processing.

Open original source Links to the regulator's original publication or another source.