Enforcement · Czech DPA (UOOU) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Company: Insufficient legal basis for data processing
How it connects
Related across sources
Literature The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how Guidance Guidelines 04/2021 on Codes of Conduct as tools for transfers Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Guidance Opinion 17/2020 on the draft Standard Contractual Clauses submitted by the SI SA (Article 28(8) GDPR) Case Law Google LLC v CNIL Case Law Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV
Full text
The Czech DPA imposed a fine of EUR 3,400 on a company. The data subject had concluded an energy supply contract with the controller in the past, but then duly terminated it. Nevertheless, the controller assigned the previously terminated contract to a processor (sales representative) in order to contact the data subject to conclude a new contract. The DPA found that the controller had unlawfully transferred the data subject's data to the sales agent, as in the absence of an existing contract it had no valid legal basis for such transfer.
Industry: Transportation and Energy
Original document at the source www.uoou.cz