Basaren Drift AS: Insufficient legal basis for data processing

The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 19,900 on Basaren Drift AS. The controller had installed video cameras in its premises which recorded both its employees and customers. The Norwegian DPA concluded that the controller had no legal basis for the camera surveillance. In addition, the Norwegian DPA found that the controller did not provide sufficient information on the surveillance to the data subjects.

GDPR Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR
Industry: Accomodation and Hospitality