Unknown

Kirjeldus

A person had received an invoice for ordered goods, which, however, came from a different company than the one from which she had ordered the goods. Therefore, the data subject contacted the company that had supplied the goods and requested information about where her personal data had been obtained from, how it had been processed and on what legal basis it had been processed. As the company did not respond to her request, the data subject contacted the DPA. The DPA then demanded the controller to provide the data subject with the requested information immediately. As the controller did not respond to this request either, the DPA imposed a fine in the amount of EUR 1,900.