HERTZ DE ESPAÑA, S.L.

What happened

The Spanish DPA held that sending someone notifications regarding monetary fines directed at another person constitutes a violation of Article 5(1)(f) GDPR. As the respective data was not rectified in time after receiving a complaint, it also resulted in a breach of Article 32 GDPR.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(f)Read →
• Art. 32Security of processingRead →
• Art. 58Powers58(2)(d)Read →
• Art. 60Cooperation between the lead supervisory authority and the other supervisory authorities concernedRead →
• Art. 83General conditions for imposing administrative fines83(2) · 83(4)(a) · 83(5)(a)Read →

• Data principles
• Data security