Mr X (The complainant) v. Y Housing company (The defendant)

€1500 in fines

Excerpt

The company was held liable for insufficient clarity in information, and the absence of a clear cookie policy or consent for the use of cookies.

Our analysis

In this case, the data subject lived in social housing provided by the controller and raised multiple issues at different times. These issues included inadequate information provided when exercising the right of access, an insufficiently secure website with a vague privacy policy, no clear cookie policy, and no consent asked for the usage of cookies. The retention period of personal data was also not discussed, and it was unclear why certain personal data of medical nature was required. The DPA upheld that a privacy policy should serve to fully inform the data subject about what is actually done with his or her personal data and in what context those data are processed. Any processing of personal data should be lawful, proper, and transparent. Data subjects should be clearly informed of what data is being processed, how the processing is being carried out, and why the personal data is being processed. However, the Privacy Sheet presented did not adequately inform the data subjects, particularly as they were socially disadvantaged people, and the language used must be clear and plain. The DPO was not properly designated or communicated to the data subject, and the DPO was not involved in all data protection matters, breaching Article 38(1) GDPR. Additionally, no consent was asked for the Google-DoubleClick.net cookie, breaching Article 6(1) GDPR. The processing of personal data through cookies without consent is not legally valid.

Outcome

The DPA has ordered a private housing company to become compliant with data protection regulations within three months and pay a fine of €1500. The DPA does not consider the housing company to be a "public authority or public body" under Article 83(7) of the DPA, which exempts such bodies from administrative fines. This concept is defined by Union law and is subject to an autonomous and uniform interpretation by Union institutions, particularly the Court of Justice.

Parties

Mr X (The complainant) and Y Housing company (The defendant)

Case number

73/2020

Related deceptive patterns

Related laws

Legal enforcement database by Leiser, Santos and Doshi

The information about laws and cases on this website is brought to you by the Leiser, Santos and Doshi enforcement database.

About us