GSMA Limited
€600,000
Insufficient legal basis for data processing
Ngày ra quyết định
31 tháng 5, 2024
Thẩm quyền
Spanish Data Protection Authority (aepd)
ES
Ngành
Individuals and Private Associations
Quốc gia
ES
Luật
GDPRTrạng thái
FINALMô tả
The Spanish DPA has imposed a fine of EUR 600,000 on GSMA Limited. In 2022, GSMA Limited required employees of its suppliers to register on an online platform and upload proof of vaccination against COVID-19. One of the data subjects filed a complaint with the DPA as they considered the data processing to be unlawful. GSMA referred to a legal obligation and public interest, but could not provide a specific legal basis. The DPA found that less invasive safeguards would have been possible and that the affected workers were not sufficiently informed about the data processing.
Trích dẫn pháp lý
Art. 6 (1)Art. 9 (2)Art. 14
Vấn đề & Vi phạm
Insufficient legal basis for data processing