Background information
Date of final decision: 14 August 2021
Cross-border case or national case: National case
Controller: Waxing Palace AS
Legal Reference: Legal basis (article 6), lawfulness, fairness and transparency (article 5 (1) (a)), data minimisation (article 5 (1) (c)), Transparent information (article 12 (1)), Information (article 13)
Decision: Infringement declared and fine imposed
Key words: Surveillance monitoring
Summary of the Decision
Origin of the case
Having investigated a complaint relating to CCTV monitoring of salon premises, the Data Protection Authority has concluded that the enterprise did not have a legal basis for its monitoring. The Data Protection Authority also found that the enterprise did not satisfactorily inform visitors or employees of its CCTV monitoring.
Key Findings
The Data Protection Authority finds that this case is so severe that a fine is the appropriate sanction.
The Norwegian Data Protection Authority has fined Waxing Palace AS EUR 10,000. The enterprise operates a waxing salon, and their CCTV monitoring of the reception area has been found to be in breach of the General Data Protection Regulation (GDPR).
The fine amount is based on an overall assessment, taking into account the severity of the offence and the financial situation of the enterprise.
Decision
The Norwegian Data Protection Authority has fined Waxing Palace AS EUR 10,000
For further information:
https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/gebyr-til-waxing-palace-as/ (NO)
https://www.datatilsynet.no/en/news/2021/waxing-palace-as-fined/ (EN)
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned