Excerpt
Czech DPA fined a broadcaster as the information it provided was not provided in an easily accessible manner, incomplete and outdated.
Our analysis
During the inspection, the DPA (Data Protection Authority) verified the compliance of a television broadcaster, who was a controller, with regards to the use of cookies on its multimedia websites under the GDPR (General Data Protection Regulation). The controller had informed its users about the use of cookies for setting usernames, language, and analytics purposes, but failed to update its privacy policy in an easily accessible manner and with complete and updated information. The controller had also taken technical and organizational measures to secure the data of its users, which had been regularly updated and documented in the privacy policy. However, the DPA found a violation of Article 12(1) and Article 12(2) GDPR due to incomplete and outdated information in the privacy policy and failure to notify users about its update. The controller rectified the violation during the inspection, but a fine was still imposed.
Outcome
During the inspection, it was found that the controller had violated Article 12(1) GDPR and Article 12(2) GDPR, which required them to provide clear and comprehensive information to data subjects about the processing of their personal data. As a result, the controller was fined. However, it was also found that the controller had failed to cooperate with the inspection, which resulted in a separate fine of CZK 100,000 (approx. €3800) being imposed. The illegal condition was rectified during the inspection, but the lack of cooperation was still considered a serious breach.
Parties
Czech DPA and Anonymous Television Broadcaster
Case number
UOOU-00374/20
Decision
Related deceptive patterns
Sneaking involves intentionally withholding or obscuring information that is relevant to the user (e.g. additional costs or unwanted consequences), often in order to manipulate them into taking an action they would not otherwise choose.
The trick wording deceptive pattern takes advantage of user expectations and ambiguous language to mislead and deceive users. It is normal for users to scan-read when they are online, as a way to cope with the sheer volume of information they are faced with. This means they don't read and dwell on every word on every page. Trick wording usually takes advantage of the scan reading strategy, by making a piece of content look like it is saying one thing, when in fact it is saying something else that is not in the user's best interests.
Related laws
Ensures transparent information and easy access for individuals to their personal data processing, with the right to obtain a copy in a clear and common format.