Bonnier News AB: Insufficient legal basis for data processing

The Swedish DPA has imposed a fine of EUR 1.1 million on Bonnier News AB. During its investigation, the DPA found that Bonnier News collects customer data, for example, through their surfing behavior or through purchases from different subsidiaries. However, the DPA also found that Bonnier News had collected and processed this data without the consent of the data subjects. Bonnier News relied on an predominant interest as a legal basis, but the DPA noted that customers could not expect their data to be collected for marketing purposes just because they visit a website, for example. For this reason, the DPA clarified that such extensive profiling would require the consent of the data subjects. In assessing the fine, mitigating consideration was given to the fact that Bonnier News had taken comprehensive measures to limit the harm to data subjects.

GDPR Articles: Art. 6 (1) GDPR
Industry: Media, Telecoms and Broadcasting