Enforcement · Autoriteit Persoonsgegevens EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

A.S. Watson Health & Beauty Continental Europe B.V.: Insufficient legal basis for data processing

€50,000 Fine
A.S. Watson Health & Beauty Continental Europe B.V.
THE NETHERLANDS
Art. 5 GDPR
Cookies Controllers Healthcare Personal Data Consent Processors Right to Object Monitoring
May 2, 2024 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Case Law Meta Platforms v noyb CJEU News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Case Law GC and Others v CNIL CJEU Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Case Law Peter Nowak v Data Protection Commissioner CJEU

Full text

The Dutch DPA has imposed a fine of EUR 600,000 on A.S. Watson Health & Beauty Continental Europe B.V.. The controller had tracked visitors to their drugstore website “Kruidvat.nl” with tracking cookies without their consent. The cookie banner on the website had the boxes for consenting to the placement of tracking software pre-ticked by default. Visitors who nevertheless wanted to reject the cookies could only do so with greater difficulty. This allowed the controller to collect sensitive personal data from millions of website visitors and create profiles. Among other things, the controller collected location data and information on purchased products. Since the products purchased included drugstore products, it was also possible to draw conclusions about health conditions based on the purchase of pregnancy tests or medication, for example. ---UPDATE --- Following an objection filed by the processor, the DPA reduced the fine from EUR 600,000 to a sum of EUR 50,000.

Industry: Industry and Commerce

Original document at the source autoriteitpersoonsgegevens.nl

Similar Content