Details:
| Summary | The Spanish DPA has imposed a fine of EUR 17,000 on FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA. Athletes were required to upload the vaccination certificate against COVID with the complete vaccination schedule or a certificate of recovery from the disease or an antigen test with a negative result to the controller’s website 48 hours before sports events in order to participate in sports competitions. During its investigation, the DPA found that the controller did not have a valid legal basis for processing this sensitive health data. The DPA also found that the controller had not provided sufficient information about the processing of personal data. |
| Link: | link |
| Related articles: | Art. 9 GDPR, Art. 13 GDPR |
| Type: | Insufficient legal basis for data processing |
| Fine: | EUR 17,000 |
| Sector | Public Sector and Education |
All data is based on The CMS’s Law GDPR Enforcement Tracker Source: https://www.enforcementtracker.com/