Homeowners Association: Insufficient legal basis for data processing
€2,000 fine - Spanish Data Protection Authority (aepd)
Content
The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An individual who did cleaning work in the residential complex had filed a complaint with the DPA because members of the association had added them to a WhatsApp group without their consent. The data subject was required to upload pictures of the cleaning they had done for documentation purposes. The DPA concluded that adding their phone number to the WhatsApp group without their consent violated Art. 6 GDPR and was therefore unlawful. The DPA also found that the controller had not complied with the data subject's request for access to personal data in a timely manner, therefore violating Art. 15 GDPR.
GDPR Articles: Art. 6 (1) GDPR, Art. 15 GDPR
Industry: Employment