DPA case 24FR/2022 – €3,700 Fine (Luxembourg, 2022)

On 17 July 2020, the Luxembourg DPA opened an investigation at Company A, operator of a website and mobile application, to verify the compliance of its activities with Articles 12(1), 13 and 14 GDPR. The investigation focused on the users of the website and mobile application and not on the employees. The investigation showed that * the privacy policy mentioned processing operations that were not actually carried out; * the privacy policy was not available on all the pages on which the company collected data; * regarding the mobile app, no privacy policy was available before the download and once the application was installed, the privacy policy was not easily accessible; * the privacy policy was only available in two languages, whereas the website was available in three languages; and * the privacy policy did not mention the length of time for which the data would be kept or the right to restrict processing. The controller replied that the unavailability of the information was due to the attitude of the service provider who managed his site and application. The DPA considered that the privacy policy, by mentionning certain processing operations that were actually not carried out, did not reflect reality and that the controller did not provide the required information in a comprehensible manner, in clear and simple terms, in violation of Article 12(1). It also found a lack of information, in breach of Articles 13(2)(a) and 13(2)(b): the information regarding the length of time the data will be kept was missing for certain processing activities. Concerning the rights of the data subjects, there was no information about the right to restrict. The DPA therefore, in accordance with Article 58(2) and taking into account the measures already implemented by the company, imposed a fine of Є3,700 and ordered the controller to update its privacy policy to comply with the requirements of Article 12(1).