Legal Person: Insufficient legal basis for data processing

The Czech DPA has imposed a fine of EUR 400 on a legal person. The accused did not provide evidence that the data subject had consented to the scanning or copying of their ID card or other identification documents in connection with a contract for renting sports equipment. Furthermore, she failed to justify the necessity of both scanning/copying and storing these documents.

GDPR Articles: Art. 5 (1) c) GDPR, Art. 6 (1) a) GDPR, Art. 7 (1) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR
Industry: Industry and Commerce