- Enforcing jurisdiction
- Czechia · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Company – €3,400 Fine (Czech Republic, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Czech data protection authority fined a company EUR 3,400 for unlawfully transferring a person's data to a sales agent. The company had previously terminated the person's energy supply contract but still shared their information without a valid reason. This case highlights the importance of having a legal basis before sharing personal data.
What happened
A company transferred a person's data to a sales agent without a valid legal basis after the person had terminated their contract.
Who was affected
The individual who had previously entered into an energy supply contract with the company.
What the authority found
The authority ruled that the company had no valid legal basis for transferring the person's data, violating data protection rules.
Why this matters
This ruling emphasizes that companies must ensure they have a legal reason to share personal data, especially after a contract has ended. Businesses should review their data-sharing practices to avoid similar fines.
Source checks
Linked-source text retrieved.
Automated check recorded — 15 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Czech DPA imposed a fine of EUR 3,400 on a company. The data subject had concluded an energy supply contract with the controller in the past, but then duly terminated it. Nevertheless, the controller assigned the previously terminated contract to a processor (sales representative) in order to contact the data subject to conclude a new contract. The DPA found that the controller had unlawfully transferred the data subject's data to the sales agent, as in the absence of an existing contract it had no valid legal basis for such transfer.
Related Enforcement Actions (0)
No other enforcement actions found for Company in CZ
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
1 January 2022
Authority
Úřad pro ochranu osobních údajů
Fine Amount
€3,400
About this data
Cite as: Cookie Fines. Company - Czech Republic (2022). Retrieved from cookiefines.eu
Last updated: