Czech Republic
Ski rental company
GDPR enforcement action by Czech Data Protection Auhtority (UOOU) on 2020.
Case details
- Authority
- Czech Data Protection Auhtority (UOOU)
- Date
- 2020
- Controller / Processor
- Ski rental company
- Sector
- Industry and Commerce
- Quoted Articles
- Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 7 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR
- Type of violation
- Non-compliance with general data processing principles
Summary
The Czech DPA (UOOU) imposed a fine against a ski rental company. Due to the high value of the sports equipment, the controller required a financial deposit or a full copy of a valid ID when renting sports equipment. The consent to the copy of the ID was included in the sports equipment rental agreement itself. Thus, when the sports equipment rental agreement was signed, consent to the processing of the ID copy was obtained at the same time. The DPA considered this method of obtaining consent to be a violation against the lawfulness of the processing. In addition, it was found that the data subjects were not properly informed about the processing of their personal data.
Related fines