Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
GSMA Limited: Insufficient legal basis for data processing
How it connects
Related across sources
Case Law Deutsche Wohnen SE v Staatsanwaltschaft Berlin Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR Case Law Data Protection Commissioner v Facebook Ireland and Maximillian Schrems Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II)
Full text
The Spanish DPA has imposed a fine of EUR 600,000 on GSMA Limited. In 2022, GSMA Limited required employees of its suppliers to register on an online platform and upload proof of vaccination against COVID-19. One of the data subjects filed a complaint with the DPA as they considered the data processing to be unlawful. GSMA referred to a legal obligation and public interest, but could not provide a specific legal basis. The DPA found that less invasive safeguards would have been possible and that the affected workers were not sufficiently informed about the data processing.
Industry: Individuals and Private Associations
Original document at the source www.aepd.es