The Netherlands

Unknown Organisation

725,000 €

GDPR enforcement action by Dutch Supervisory Authority for Data Protection (AP) on 2020-04-30.

Rank · Sector

of 213 in Employment

Rank · The Netherlands

#12

of 43

Rank · All fines

#207

of 3,050

Case details

Authority: Dutch Supervisory Authority for Data Protection (AP)
Date: 2020-04-30
Controller / Processor: Unknown Organisation
Sector: Employment
Quoted Articles: Art. 5 GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The organisation had required its staff to have their fingerprints scanned to record attendance. However, as the decision of the data protection authority stated, the organisation could not rely on exceptions to the processing of this special category of personal data and the company could also not provide any evidence that the employees had given their consent to this data processing.

Open original source Links to the regulator's original publication or another source.