Sanction RGPD Spanish Data Protection Authority (aepd) — GSMA Limited : 600 k€ (2024)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- GSMA Limited
- Montant de l'amende
- 600 k€
- Date de la décision
- 31 mai 2024
- Fondement juridique
- Art. 6 (1), Art. 9 (2), Art. 14
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Spanish DPA has imposed a fine of EUR 600,000 on GSMA Limited. In 2022, GSMA Limited required employees of its suppliers to register on an online platform and upload proof of vaccination against COVID-19. One of the data subjects filed a complaint with the DPA as they considered the data processing to be unlawful. GSMA referred to a legal obligation and public interest, but could not provide a specific legal basis. The DPA found that less invasive safeguards would have been possible and that the affected workers were not sufficiently informed about the data processing.