A used car dealer was fined 6 million Czech korunas by the authority for unsolicited spam. The Czech Office for Personal Data Protection thus imposed the largest penalty for this type of violation in its entire history. However, it did not disclose the company’s name.
Repeated and unsolicited promotional messages containing offers of goods and services related to the purchase and sale of nearly new and used vehicles were sent to nearly 500,000 email addresses. The offers included servicing, financing options, and vehicle appraisals. Some recipients who had not consented to the processing of their personal data for marketing purposes filed complaints. “However, the Office did not focus solely on the complaints themselves, but also on the legal basis used for sending commercial offers,” explained Martina Šnajderová, head of the Commercial Offers Department at the Czech Office for Personal Data Protection.
In the case under investigation, the processing would have been lawful only if the data subject (in this case, the recipient) had given consent to the processing of their personal data for specific purposes pursuant to Article 6(1)(a) of the GDPR. Since the company was unable to demonstrate that the recipients in question had specifically consented to receiving commercial offers, the Office found a systemic violation in this area, for which the aforementioned penalty was imposed.
The company has already paid the fine imposed for sending unsolicited spam.
Sources: The full decision of the Office for Personal Data Protection regarding this case is available at: https://www.uoou.cz/uoou-ulozil-nejvyssi-pokutu-za-nbsp-spam-ve-nbsp-sve-historii/d-45143
