Administrative fine of €13.9 million imposed by the Czech Data Protection Authority on a company for breach of Articles 6 and 13 of GDPR

The National Center for Personal Data Protection (NCPDP), for information and enforcement, communicates about the administrative fine in the amount of 13.9 million euro imposed by the Czech Data Protection Authority (SA) on a company registered in the Czech Republic for violation of Article 6 Lawfulness of processing and Article 13 Information to be provided where personal data is collected from the data subject of the GDPR.

The case concerns the transfer by controller of personal data collected by it from users of its anti-virus software to an affiliated company. The proceedings were initiated on the basis of media reports and an anonymous file.

Following the investigation, the Czech SA found that the controller transferred personal data of users of anti-virus software and browser extensions to the affiliated company without having a legal basis for such processing. The transferred data related to approximately 100 million users and included in particular the pseudonymized web browsing history of the users linked to a unique identifier. In addition, the Czech SA found that the controller misinformed its users (data subjects) about these data transfers, as it claimed that the transferred data were anonymized and used exclusively for statistical sales analysis. At the same time, the Czech Data Protection Authority concluded that Internet browsing history, even if not complete, may constitute personal data, as re-identification of at least some of the data subjects could occur. The controller’s breach is all the more serious as it is one of the leading experts in the field of cybersecurity, providing the public with data protection and privacy tools.

An administrative fine of €13.9 million (CZK 351 million) was imposed on the data controller. The decision is final and enforceable.

The NCPDP as the national supervisory authority for the processing of personal data, emphasizes the responsibility of data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the applicable legislation.