Sanction RGPD Norwegian Supervisory Authority (Datatilsynet) — Miljø- og Kvalitetsledelse AS : 3 k€ (2021)
- Autorité de contrôle
- Norwegian Supervisory Authority (Datatilsynet)
- Pays
- Norvège
- Entreprise / secteur
- Miljø- og Kvalitetsledelse AS
- Montant de l'amende
- 3 k€
- Date de la décision
- 9 avril 2021
- Fondement juridique
- Art. 5 (1) a), Art. 6 (1)
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 3,400 on Miljø- og Kvalitetsledelse AS. At one of the carwashes operated by the controller, incidents of vandalism had occurred at the payment terminal. The controller thereupon sent footage of the incident from a surveillance camera to the employer of the alleged vandal. The Norwegian DPA concluded that the sharing of the video footage had taken place without a legal basis and the controller had thus violated Art. 6 (1) GDPR and Art. 5 (1) a) GDPR. Furthermore, the DPA emphasizes that the disclosure of the recordings was not necessary to clarify the incident, as the recordings had already been provided to the police.