AEPD - PS/00249/2020
|AEPD - PS/00249/2020|
|Relevant Law:||Article 5(1)(b) GDPR|
Article 83(5)(a) GDPR
72 (1) (a) LOPDGDD
72 (1) (a) LOPDGDD
|National Case Number/Name:||PS/00249/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Francesc Julve Falcó|
The Spanish DPA (AEPD) maintains that a company can not process personal and health data for commercial purposes without the prior consent of the data subject, as this infringes Article 5(1)(b) GDPR.
The complainant used the services of the defendant to download weekly menus. The complainant discovered days later that this company has used their personal data, full name and profile picture, and information about her cholesterol tests and her heart disease (hypothyroidism) to advertise their products, without her prior consent.
The Spanish DPA tried to contact the company in question and there was no response so the sanctioning procedure was initiated.
Is the processing of personal and health data for commercial purposes without prior consent a breach of Article 5(1)(b) GDPR?
The Spanish DPA decided to impose a fine of € 3000 on the company in question for breach of data processing duties, as the complainant had not given their consent for their personal data or data on their state of health to be used for advertising purposes.
In this case, the aggravating factors applied are that it is an unintentional but significant negligent action (Article 83(2)(b) GDPR) and that basic identifiers such as name, surname, and address are affected (Article 83(2)(g) GDPR), including also health data, when reporting the claimant's cholesterol tests, and their illness (hypothyroidism).
The sanctioned company made use of the following penalty reductions: recognition of its responsibility (20%) and voluntary and advance payment (20%). The penalty was therefore reduced from € 3000 to € 1800.
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.