Enforcement · Data Protection Authority of Berlin EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Company: Insufficient involvement of data protection officer

€525,000 Fine
Company
GERMANY
Art. 38 GDPR
Notified Body Responsibilities and Operational Obligations Supervisory Authorities Processing Agreement Law Enforcement Personal Data Scientific Panel Independence Notified Body Independence
Sep 20, 2022 Source

How it connects

Related across sources

News Data Protection Officer or Chief Privacy Officer?The rise of the Data Protection Officer White Label Consultancy Guidance Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB News Kunnen organisaties efficiëntieverbeteringen realiseren door de functies van Data Protection Officer (DPO) en klokkenluider te combineren? IAPP News Can the roles of DPO and whistleblowing officer be merged? IAPP News De IJslandse toezichthouder heeft geoordeeld dat er sprake is van een belangenconflict wanneer een Functionaris Gegevensbescherming (FG) tegelijkertijd ook de hoofdjurist van een bedrijf is. GDPRhub News Het Italiaanse bedrijf SA heeft juridische stappen ondernomen tegen een gemeente vanwege het gebruik van haar videosurveillance systeem en omdat het haar Functionaris Gegevensbescherming (FG) heeft aangesteld om de gemeente in een rechtszaak te vertegenwoordigen. GDPRhub

Full text

The DPA of Berlin has imposed a fine of EUR 525,000 on the subsidiary of a Berlin-based e-commerce group. The company had appointed a data protection officer, who however was also the managing director of two service companies that processed personal data on behalf of the very same company for which they acted as data protection officer. These service companies are also part of the group to which the e-commerce company belongs. The DPA considered this to be a conflict of interest and found a violation of Art. 38 (6) GDPR. The DPA had already issued a warning to the company in 2021 due to the conflict of interest. When a new inspection this year revealed that no new data protection officer had been appointed, the DPA imposed the fine.

Industry: Industry and Commerce

Original document at the source www.datenschutz-berlin.de

Similar Content