Restaurant operator
Not Available
Insufficient legal basis for data processing
Decision Date
January 1, 2022
Authority
Data Protection Authority of Berlin
DE
Sector
Accomodation and Hospitality
Country
DE
Law
GDPRStatus
FINALDescription
The DPA of Berlin has imposed a fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with their personal data for the purpose of contact tracing as required by law. However, the controller unlawfully used the data to send promotional messages to the data subjects.
Legal Citations
Art. 5Art. 6
Issues & Violations
Insufficient legal basis for data processing