GDPR Fines

A public record of GDPR enforcement across Europe — compiled by INPLP members

Police Officer

Country
Germany
Fine
1,400 EUR
Date
2019-05-09
Sector
Private Sector
Articles
Art. 6 GDPR

Insufficient legal basis for data processing

Using his official user ID, but without reference to official duties, a police officer used the Central Traffic Information System of the Federal Motor Transport Authority to query the owner data of the license plate of a person he did not know well. After that, he carried out a query with the Federal Network Agency, in which he queried the personal data and the house and mobile phone numbers stored there. Using this mobile phone number, he contacted the person by telephone. He did that all without official justification or consent from the injured party. Through queries for private purposes and the use of the phone for private contact, the police officer processed personal data on his own responsibility. This violation is not attributable to the police officer's office, as he commited the offence exclusively for private purposes and not in the exercise of his official duties. The prohibition of punishment in Sect. 28 of the respectice Local Data Protection Act (Landesdatenschutzgesetz - LDSG), according to which the sanctions of the GDPR cannot be imposed on public authorities, does therefore not apply in this case. Authority: Data Protection Authority of Baden-Wuerttemberg