Company
Insufficient legal basis for data processing
결정 날짜
2022년 11월 29일
권한
Spanish Data Protection Authority (aepd)
ES
섹터
Industry and Commerce
국가
HU
법률
GDPR상태
FINAL설명
The Spanish DPA has imposed a fine of EUR 3,000 on a company. The controller had installed a video surveillance system that also recorded the voices of both employees and customers. During its investigation, the DPA found that the controller did not have a valid legal basis for processing the information of the voices as part of the video surveillance. In addition, the DPA found that the controller failed to provide sufficient information about the video surveillance, including information about the processing, the identity of the controller, and the exercise of data subjects' rights.