Dutch DPA
- Country
- Netherlands
- Fine
- 15,000 EUR
- Date
- 2021-05-19
- Sector
- Business Sector
- Articles
- Art. 9(1) enArt. 32(1) GDPR
A maintenance company (CP&A) is fined because of a violation of art. 9,lid 1 by processing health data of its employees. In addition, CP&A did not take adequate security measures for these data processing.
The CP&A absenteeism registration contained highly sensitive information about the physical and/or mental health of employees. Such as the names of diseases, specific complaints and indications of pain. Health data are special personal data that require extra protection. With knowledge of a person's physical and emotional state, an employer could make judgments or decisions that have a major impact on an employee. It is not necessary for an employer to process this information for the reintegration of employees. Everyone has the right to keep it to themselves as much as possible. That also applies to employees. However, an employee may feel obliged to provide that information to his employer. Application of the principle of proportionality may inter alia play in the accumulation of sanctions and the capacity of the responsible data processor. In this case initially the AP sets the fine for violation of Article 9, first paragraph, of the GDPR at € 725,000. And for the violation of Article 32, first paragraph, of the GDPR, the AP sets the fine at € 310,000. CP&A has invoked limited financially capacity. Based on the at that moment known financial knowledge the AP considers the financial capacity of CP&A to be limited, as a result of which the AP is up to the conclusion that CP&A cannot afford the fine of €1,035,000 financially. On this basis, the AP sees reason to reduce the fine. The AP is of the opninion a fine of € 15,000 appropriate in this case.
Additional information
Application of the principle of proportionality may inter alia play in the accumulation of sanctions and the capacity of the responsible data processor. In this case initially the AP sets the fine for violation of Article 9, first paragraph, of the GDPR at € 725,000. And for the violation of Article 32, first paragraph, of the GDPR, the AP sets the fine at € 310,000. CP&A has invoked limited financially capacity. Based on the at that moment known financial knowledge the AP considers the financial capacity of CP&A to be limited, as a result of which the AP is up to the conclusion that CP&A cannot afford the fine of €1,035,000 financially. On this basis, the AP sees reason to reduce the fine. The AP is of the opninion a fine of € 15,000 appropriate in this case.