Background information
- Date of decision: 31/08/2022
- Cross-border case or national case: National case
- Legal references: Article 31 (Co-operation with the supervisory authority), Article 58 (2) (i) and (1) (a) and (e) GDPR, Article 83 (1-3) and (4) (a) and 5 (e) GDPR (General conditions for imposing administrative fines)
- Decision: Administrative fine
- Key words: Administrative fine, Cooperation with the supervisory authority, CCTV
Summary of the Decision
Origin of the case
The Polish SA initiated ex officio proceedings against the controller, who failed to respond to several requests for information regarding a complaint which involved recording of the data subject’s image by video surveillance without a legal basis, and failure to comply with the information obligation to the data subject (Article 15 of GDPR). The controller did not take any action in response to the information about the initiation of the proceedings as well as requests to provide necessary information for the handling of the case.
Key Findings
In order to handle the complaint, the Polish SA requested the controller to respond to the content of the complaint, to provide explanations regarding the case, in particular to answer a number of detailed questions on relevant issues, as well as to provide evidence supporting the explanations provided. This request was addressed through the postal service to the controller at the address indicated by the complainant. A misdelivery notice was sent twice, yet the letter was not received by the addressee. It returned to the sender with the notation "RETURN not taken in time". In the absence of a response to the supervisory authority’s request, the Polish SA again requested explanations from the controller. This request - also addressed to the controller’s home address - was received by the controller in person, but remained without any response. The Polish SA made another - the third - request for information necessary to investigate the complaint. And this time the letter was received by the controller in person, but again remained without any response. In connection with the controller’s failure to provide the information necessary for the handling of the case, the Polish SA initiated ex officio proceedings against the controller for the imposition of an administrative fine, of which the controller was informed by letter, but did not reply.
Decision
It is undisputed that the Polish SA did not obtain the requested information from the controller, in violation of GDPR provisions. Faced with the violation, the Polish SA imposed a fine of nearly EUR 1,510 on the controller.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.