Enforcement · Data Protection Authority of Brandenburg EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Restaurant operator: Insufficient legal basis for data processing

Restaurant operator
GERMANY
Art. 5 GDPR Art. 6 GDPR
Direct Marketing Consent Personal Data Processing Agreement Processing Healthcare Supervisory Authorities Law Enforcement
Jan 1, 2022 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Guidance EDPB Annual Report 2019 EDPB Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ Spain: Preparations for a New Law on Data Protection to Implement the GDPR European Data Protection Law Review Literature GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR European Data Protection Law Review

Full text

The DPA of Brandenburg has imposed a five-figure fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with their name, address, telephone number and e-mail address for the purpose of contact tracing as required by law. However, there was no legal requirement to collect the e-mail address. Visitors were further required to check a box stating that they agreed to be contacted by the restaurant. However, the restaurant subsequently used the email addresses to send a promotional newsletter. During its investigation, the DPA found that the processing of the email address for advertising purposes was unlawful due to the fact that the requirements for giving effective consent were not met. After all, it was not clear to the data subjects that the restaurant intended to use the e-mail address for advertising purposes. The restaurant operator also failed to inform the data subjects of their right to withdrawal.

Industry: Accomodation and Hospitality

Original document at the source www.zaftda.de

Similar Content