Unknown – Order (Germany, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A cemetery in Germany was ordered to stop using visitor contact information for personal reasons. This ruling is significant because it clarifies that personal data collected for health reasons cannot be misused.
What happened
A cemetery employee used visitor contact information for personal inquiries instead of for health tracking.
Who was affected
Visitors who provided their contact details for health tracking were affected by this misuse.
What the authority found
The DPA found that the cemetery unlawfully used personal data collected for infection control documentation.
Why this matters
This case underscores the importance of using personal data only for its intended purpose. Organizations must ensure that they handle personal information responsibly, especially during health crises.
In order to combat the Covid 19 pandemic, a cemetery had put out an open list in which visitors had to enter their contact data. A cemetery employee obtained first names, last names, and phone numbers of women from the contact lists in order to contact the women privately and ask them about their relationship status, among other things. The DPA determined that the use of personal data from contact lists for infection control documentation outside of contact tracing was unlawful and therefore imposed a fine.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (8)
Other enforcement actions involving Unknown in DE
Order
Details
Order Date
1 January 2021
Authority
Bundesbeauftragter für den Datenschutz
Enforcement Tracker ID
ETid-1211
About this data
Cite as: Cookie Fines. Unknown - Germany (2021). Retrieved from cookiefines.eu
Last updated: