Burgos Club de Fútbol, S.A.D.

What happened

The DPA fined a football club €200,000 for lacking a legal basis to process fingerprint data and violating obligations of necessity and proportionality. The controller acknowledged its fault and paid a reduced fine of €120,000 in accordance with national law.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(c)Read →
• Art. 8Conditions applicable to child's consent in relation to information society servicesRead →
• Art. 9Processing of special categories of personal dataRead →
• Art. 13Information to be provided where personal data are collected from the data subjectRead →
• Art. 35Data protection impact assessmentRead →

• Consent
• DPIA
• Data principles
• Special categories
• Transparency