Enforcement · Czech DPA (UOOU) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

CZECH REPUBLIC DPA: Insufficient legal basis for data processing

Czech Data Protection Auhtority (UOOU)

Czech Data Protection Auhtority (UOOU)

Unknown
CZECH REPUBLIC
Art. 5 GDPR Art. 6 GDPR
Controllers Personal Data Processing Supervisory Authorities Direct Marketing
May 26, 2020 Source uoou.cz

Full text

The Czech DPA (UOOU) imposed a fine against a company for processing personal data without a sufficent legal basis. Several individuals were contacted by the sales staff of the controller for advertising purposes. The data subjects had used the services of the sales staff in the past (until around 2016) to conclude insurance or financial contracts. However, at that time, the sales staff were working for a different company with which they had concluded an agency contract. The DPA notes that on the one hand the use of the personal data known to the representatives from their previous activity constitutes a breach of the contract concluded with the previous company, and on the other hand no legal basis existed for the further processing of the data for advertising purposes in favour of the controller.

Industry: Industry and Commerce

How it connects

References

Related across sources

C-17/22 HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG and Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG v Müller Rechtsanwaltsgesellschaft mbH and Others The Court of Justice of the European Union (Fourth Chamber) issued a preliminary ruling in joined cases C-17/22 and C-18/22, originating from the Amtsgericht München, concerning… CJEU ·Fourth Chamber Sep 12, 2024 Legitimate Interest Personal Data Fairness & Transparency
C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) CJEU Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing
C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens The CJEU ruled on a preliminary reference from the Amsterdam District Court in proceedings between the Koninklijke Nederlandse Lawn Tennisbond (KNLTB) and the Dutch Data… CJEU ·Ninth Chamber Oct 4, 2024 Personal Data Legitimate Interest IP Address
CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is Processing: Communication of personal data in response to a request for access to documents constitutes processing. (¶69) Jun 29, 2010 Personal Data Legitimate Interest Right to Restriction
Ro 2022/04/0026 Austrian VwGH: hotel listings and user reviews on travel platform serve legitimate The data subjects, joint operators of a hotel and restaurant business, ran their establishment through a family business. The controller operates an online travel platform… May 17, 2024 Legitimate Interest Right to be Forgotten Personal Data
Guidelines 01/2022 data subject rights - Right of access Guidelines ·EDPB Apr 17, 2023 Right of Access Personal Data Right to Rectification
Related documents