Background information
Date of final decision: 14 January 2022
Cross-border case or national case: National
Controller: DPG Media Magazines B.V.
Legal Reference: article 12 (2) GDPR
Decision: Infringement of the GDPR, administrative fine
Key words: identity document; personal data; transparency
Summary of the Decision
Origin of the case
The Dutch Supervisory Authority (SA) received various complaints regarding how Sanoma Media Netherlands B.V. (before Sanoma was taken over by DPG Media in April 2020) handled requests from people to view their data or have their data deleted. These complaints were submitted by people who, for example, had a magazine subscription or had received advertisements from Sanoma.
Key Findings
Anyone who wanted to know what personal data of theirs Sanoma and DPG Media kept or who wanted their data deleted was required to first upload or send in a copy of their identity document. What’s more, when sending such a copy electronically, they were not informed by Sanoma and DPG Media that they could redact certain data. Identity documents include a lot of personal data. Even if parts are redacted, it will often be disproportionate to require a copy of an identity document in order to confirm that a person really is who they claim to be. In requiring people to provide a copy of their identity document, Sanoma and DPG Media requested too much data.
The company thus made it overly complicated for customers to access their data or have their data deleted.
After taking over Sanoma, DPG Media changed its practices. DPG Media now confirms the identity of a person requesting access to their data or deletion of their data by sending a verification email. The violation is therefore no longer being committed.
Decision
The Dutch Supervisory Authority (SA) has imposed a fine of €525,000 on DPG Media. The media company had required people wanting to view their data or have their data deleted to first upload a copy of an identity document. The situation did not necessitate this. DPG Media therefore collected too much personal data.
DPG Media has lodged an objection to this fine.
For further information: decision in national language AP: Boete DPG Media voor onnodig opvragen identiteitsbewijs, Autoriteit Persoonsgegevens
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.