The Dutch Personal Data Authority is fining DPG Media 525,000 euros. DPG Media Magazines allegedly violated GDPR rules.
DPG Media will receive a GDPR fine of 525,000 euros. This was decided by the Dutch Personal Data Authority. DPG Media owns brands in our country including VTM, Humo and Het Laatste Nieuws. The group also operates in the Netherlands with brands such as Algemeen Dagblad and Music. The Belgian media group acquired publisher Sanoma in 2020 and renamed that branch DPG Media Magazines in the Netherlands. That is where the breach took place.
Sanoma customers who wanted to know what data the publisher had on them had to send a copy of their ID to do so. They also had to do so when they wanted to change or cancel their subscription to a magazine. The Dutch authority received several complaints about this in 2018 and 2019. The problems thus occurred before the acquisition by DPG Media, which does share responsibility through the acquisition.
Disproportionate demand
According to the Dutch, Sanoma did not make customers sufficiently transparent at the time about ways to protect their data. In its decision, the authority called it “disproportionate to require a copy of an identity document if the identity of the data subject can be verified by other means.”
read also
Belgian privacy watchdog fines IAB Europe for GDPR violation
“Moreover, the processing of copies of identity documents poses a high risk to the security of personal data,” the Personal Data Authority continues. “In addition, the controller cannot be sure that the copy is authentic and the owner of the identity card is actually the requester, due to, for example, (unauthorized) access to identity documents by roommates and forged copies of identity documents.”
The decision shows that it is best for companies to be careful when requesting personal data from customers. That retrieval must always be proportional. Moreover, it is up to the organization itself to handle the data securely.