Supermarket: Insufficient legal basis for data processing

The DPA of Brandenburg has imposed a five-figure fine on a company. The controller had posted a list of employees' sickness-related absences for the year 2022 in the employee break room. The list contained details of the days on which they were absent from work due to their own illness or the illness of their child. The table was displayed for four weeks and in some cases third parties such as suppliers also had access to the list.

GDPR Articles: Art. 6 (1) GDPR, Art. 9 (1) GDPR
Industry: Employment