Germany

Unknown Company

50,000 €

GDPR enforcement action by Data Protection Authority of Brandenburg on 2019.

Rank · Sector

#13

of 218 in Not assigned

Rank · Germany

#45

of 116

Rank · All fines

#698

of 3,050

Case details

Authority: Data Protection Authority of Brandenburg
Date: 2019
Controller / Processor: Unknown Company
Sector: Not assigned
Quoted Articles: Art. 15 GDPR, Art. 28 GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The data controller had engaged an external company to carry out the duties of access to data according to Art. 15 GDPR. However, the engaged company conducted the correspondence with the data subjects under its own logo and in English language, so that it was not apparent to the data subjects who was responsible for the data processing. As a result, the data controller infringed the principle of transparency laid down in Art. 12 GDPR and did not sufficiently fulfil its obligations to provide information in accordance with Art. 15 GDPR. In addition, the data protection supervisory authority found that no written contract for data processing had been concluded between the data controller and the external company, thus constituting a further breach of Art. 28 (9) GDPR.

Open original source Links to the regulator's original publication or another source.