Czech Republic

Legal Person

400 €

GDPR enforcement action by Czech Data Protection Auhtority (UOOU) on 2020-07-14.

Rank · Sector

#580

of 595 in Industry and Commerce

Rank · Czech Republic

#66

of 73

Rank · All fines

#2,915

of 3,042

Case details

Authority: Czech Data Protection Auhtority (UOOU)
Date: 2020-07-14
Controller / Processor: Legal Person
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) c) GDPR, Art. 6 (1) a) GDPR, Art. 7 (1) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Czech DPA has imposed a fine of EUR 400 on a legal person. The accused did not provide evidence that the data subject had consented to the scanning or copying of their ID card or other identification documents in connection with a contract for renting sports equipment. Furthermore, she failed to justify the necessity of both scanning/copying and storing these documents.

Open original source Links to the regulator's original publication or another source.