Sanction RGPD Spanish Data Protection Authority (aepd) — Company : 3 k€ (2022)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- Company
- Montant de l'amende
- 3 k€
- Date de la décision
- 29 novembre 2022
- Fondement juridique
- Art. 6, Art. 13
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Spanish DPA has imposed a fine of EUR 3,000 on a company. The controller had installed a video surveillance system that also recorded the voices of both employees and customers. During its investigation, the DPA found that the controller did not have a valid legal basis for processing the information of the voices as part of the video surveillance. In addition, the DPA found that the controller failed to provide sufficient information about the video surveillance, including information about the processing, the identity of the controller, and the exercise of data subjects' rights.