Sanction RGPD Data Protection Authority of Berlin — Company : 525 k€ (2022)
- Autorité de contrôle
- Data Protection Authority of Berlin
- Pays
- Allemagne
- Entreprise / secteur
- Company
- Montant de l'amende
- 525 k€
- Date de la décision
- 20 septembre 2022
- Fondement juridique
- Art. 38 (6)
- Manquement
- Implication insuffisante du DPO
Résumé des faits
The DPA of Berlin has imposed a fine of EUR 525,000 on the subsidiary of a Berlin-based e-commerce group. The company had appointed a data protection officer, who however was also the managing director of two service companies that processed personal data on behalf of the very same company for which they acted as data protection officer. These service companies are also part of the group to which the e-commerce company belongs. The DPA considered this to be a conflict of interest and found a violation of Art. 38 (6) GDPR. The DPA had already issued a warning to the company in 2021 due to the conflict of interest. When a new inspection this year revealed that no new data protection officer had been appointed, the DPA imposed the fine.