Enforcement · Data Protection Authority of Niedersachsen EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Electronics store: Non-compliance with general data processing principles

€16,000 Fine
Electronics store
GERMANY
Art. 5 GDPR Art. 17 GDPR Art. 35 GDPR
Video Surveillance DPIA Monitoring IP Address Privacy Impact Assessment Controllers Processing Processing Agreement
Jan 1, 2021 Source

How it connects

Related across sources

News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet News Irish Data Protection Commissioner Fines Instagram EUR 405M for Children Privacy Violations Hunton Andrews Kurth

Full text

The DPA from Lower Saxony has imposed a fine of EUR 16,000 on an electronics store. The company had installed a video surveillance system which permanently recorded employees, customers as well as the company's premises and technical equipment. The CCTV was installed for the purpose of protecting customers, employees, safeguarding the company's property rights and prosecuting criminal acts and vandalism. The DPA stated that the recording of employees was not necessary to ensure the purposes associated with the CCTV and was therefore disproportionate. The DPA therefore found that the controller violated the principle of data minimization under Art. 5 (1) c) GDPR. The DPA also found that the company stored the recordings excessively long and, in addition, had not conducted a data protection impact assessment.

Industry: Industry and Commerce

Original document at the source www.zaftda.de

Similar Content