FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA: Insufficient legal basis for data processing
€17,000 fine - Spanish Data Protection Authority (aepd)
Content
The Spanish DPA has imposed a fine of EUR 17,000 on FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA. Athletes were required to upload the vaccination certificate against COVID with the complete vaccination schedule or a certificate of recovery from the disease or an antigen test with a negative result to the controller's website 48 hours before sports events in order to participate in sports competitions. During its investigation, the DPA found that the controller did not have a valid legal basis for processing this sensitive health data. The DPA also found that the controller had not provided sufficient information about the processing of personal data.
GDPR Articles: Art. 9 GDPR, Art. 13 GDPR
Industry: Public Sector and Education