Enforcement · Autoriteit Persoonsgegevens EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
DPG Media Magazines B.V.: Insufficient fulfilment of data subjects rights
The Dutch DPA has imposed a fine of EUR 525,000 on DPG Media Magazines B.V.
Full text
The Dutch DPA has imposed a fine of EUR 525,000 on DPG Media Magazines B.V. The DPA had received several complaints regarding the way the controller handled requests from customers. Customers who wanted to know what kind of personal data the controller stored, or wanted to have their data deleted, first had to upload or send in proof of identity. The DPA determined that sending in proof of identity would not have been necessary for the purpose of processing the request. In addition, the mailing process presented an excessive hurdle for data subjects to exercise their rights.
Industry: Media, Telecoms and Broadcasting
How it connects
References
Related across sources
C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV C-40/17 (Fashion ID) CJEU Jul 29, 2019 Controllers Legitimate Interest Processors
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Supreme Administrative Court Jun 27, 2022 Consent Cookies Supervision
C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) CJEU Jun 5, 2018 IP Address Controllers Processors
C-293/12 Digital Rights Ireland Ltd v Minister for Communications C-293/12 (Digital Rights Ireland) CJEU Apr 8, 2014 IP Address Storage Limitation Right to be Forgotten