Background information
- Date of final decision: 25 July 2022
- National Case
- Controller: Ticketer OÜ
- Legal Reference: Lawfulness of processing (Article 6 GDPR), Information to be provided where personal data are collected from the data subject (Article 13 GDPR)
- Decision: precept, order to comply, temporary ban on processing
- Key words: privacy notice, cookie consent, third-party cookies
Summary of the Decision
Origin of the case
Estonian SA conducted a self-initiated monitoring to map the situation of a personal data processing in various ticket seller portals. The purpose was to find out how people are informed about privacy-related aspects.
Estonian SA checked the website www.ticketer.ee whether it complies with the requirements in the GDPR. Estonian SA evaluated and analysed the documents, that were submitted to the Estonian SA, and also the actual data processing on the website.
Key Findings
It was found that the privacy notice lacked, among others but not only, of data controller’s name and contact details, purpose and legal basis of the data processing, data retention period, and the rights of data subjects.
Estonian SA also inspected the third-party cookies used on the website and drew data controller’s attention to the fact that they placed cookies on the data subject’s end device without previously obtaining consent.
Decision
The Estonian SA ordered the controller to:
- align privacy notice according to the requirements set in the GDPR;
- remove third-party cookies from the website or alternatively obtain consent of data subjects to place the cookies.
Estonian SA issued a precept with a penalty payment of 5000 EUR for each unfulfilled point.
For further information: decision in national language
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.