# Restaurant operator: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Data Protection Authority of Berlin
- Date: 2022-01-01
- Original: https://www.enforcementtracker.com/ETid-1867
- Canonical: https://overview.legal/posts/47982
- Topics: Controllers, Direct Marketing, Personal Data, Processing Agreement, Processing, Data Controller, Healthcare, Supervisory Authorities

## Summary

The DPA of Berlin has imposed a fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with their personal data for the purpose of contact tracing as required by law. However, the controller unlawfully used the data to send promotional messages to the data subjects.

## Full text

The DPA of Berlin has imposed a fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with their personal data for the purpose of contact tracing as required by law. However, the controller unlawfully used the data to send promotional messages to the data subjects.

GDPR Articles: Art. 5 GDPR, Art. 6 GDPR
Industry: Accomodation and Hospitality

---
Generated by overview.legal · https://overview.legal/posts/47982 · 2026-08-22