Spanish summer-course organiser pays EU GDPR fine

Article summary

MLex has reported that an unnamed data controller has paid a fine of €300 imposed by the Spanish Data Protection Authority (DPA) for violating the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR). The controller, who organised summer courses for children, did not give parents or legal guardians any option but to agree in a contract signed prior to the course that the controller could take photos and videos of the children for further advertising purposes, the DPA said. The DPA said this was not valid consent, and that the controller had failed to meet the legal requirements. The initial fine amounted to €500, but it was reduced when the controller agreed to make a voluntary payment.