Company – Fine (Germany, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A company running an online marketplace for worn underwear was found to have failed in protecting users' privacy. They didn't remove location data from photos uploaded by users, which could reveal where the photos were taken. This highlights the need for businesses to ensure they protect user data, especially when promising anonymity.
What happened
The company failed to remove location metadata from user-uploaded photos, risking exposure of users' locations.
Who was affected
Approximately 760 women aged 18 to 50 who uploaded photos to the online marketplace.
What the authority found
The privacy authority found the company lacked proper security measures and unlawfully processed data by not cleaning location metadata, violating GDPR.
Why this matters
This case emphasizes the importance of technical measures to protect user privacy, especially for platforms promising anonymity. Businesses should ensure they strip metadata from user content to avoid privacy breaches.
GDPR Articles Cited
The DPA from Hamburg has issued a fine against a company that operates an online marketplace, especially for worn underwear. The company advertises that it guarantees one hundred percent anonymity. On the platform, users can upload photos of underwear. In most cases, smartphones or other mobile devices were used to take the photos. The camera apps of the smartphones or GPS modules of the cameras often store additional information in the image file alongside the actual image as a standard setting. Based on this data, a fairly precise localization is possible. A review by the DPA revealed that the company had not cleaned up the residual information or metadata in the uploaded photos. Consequently, the data could be entered into any map service and the exact location where the photo was taken could be determined. The number of data subjects involved was approximately around 760 women between the ages of 18 and 50. For this reason, the DPA found that the company had failed to take appropriate technical and organizational measures to ensure a level of security appropriate to the risk posed to the data subjects. In addition, the DPA concluded that the company had unlawfully processed the associated data by uploading the photos without cleaning them.
Related Enforcement Actions (20)
Other enforcement actions involving Company in DE
Fine
Details
Fine Date
1 January 2020
Authority
Bundesbeauftragter für den Datenschutz
Enforcement Tracker ID
ETid-1045
About this data
Cite as: Cookie Fines. Company - Germany (2020). Retrieved from cookiefines.eu
Last updated: