UOOU ulozil za poruseni GDPR pokutu ve vysi 351 milionu Kc

Office for Personal Data Protection imposed a fine of CZK 351 million for violation of GDPR

The President of the Office for Personal Data Protection has upheld the first instance decision finding Avast Software s.r.o. guilty of an offence in connection with the processing of personal data of users of the Avast antivirus program. According to the reasoning of the decision, the company did not sufficiently inform users of the purpose of the transfer of their personal data to a third party and transferred their personal data without a proper legal basis.

In 2019, Avast Software s.r.o. transferred to its sister company data on online behaviour of antivirus users, namely on their online search and purchase history. This sister company then made the transferred data available to marketers, offering insights into consumers' online behaviour and detailed tracking of their online journey. After the “case” was published in the media, the Office for Personal Data Protection  began to look into it and found that data of about 100 million users of the internet search engine security add-on across the European Union were involved.

While the company argued that the data was anonymised and used only to determine general internet trends and consumer preferences, according to the Office for Personal Data Protection, the offered and transferred data  "on a click-by-click basis" was not sufficiently anonymised and allowed the data subject to be reversely identified.

Although Avast Software s.r.o. prohibited any reverse identification of individuals in the contract with its sister company to which it transferred the users’ personal data, the Office for Personal Data Protection reminded that only the other party to the contract, and not the data subjects, could demand compliance with the contractual obligation. At the same time, the contracting parties may decide to amend or terminate the contract at any time. Thus, according to the Office for Personal Data Protection, a contractual prohibition of reverse identification does not amount to sufficient anonymisation or pseudonymisation.

While the Office for Personal Data Protection partially agreed with the company that the purpose of the processing of personal data was for priorly declared statistical purposes, it also pointed out that there is a difference between statistical processing directly by the data controller for its own purposes and their transfer to a third party that can identify individual data subjects based on the transferred data.

Therefore, the President of the Office for Personal Data Protection upheld not only that the company committed an offence, but also a record fine of CZK 351 million. He admitted that the amount of the fine is incomparable to fines previously imposed by the Office for Personal Data Processing; however, he described the case as completely unprecedented in terms of, among other things, the scope of the data and the number of subjects concerned.

We continue to monitor further developments in the area of data protection and will keep you informed. If you would like more detailed information, please contact the authors of this article or other members of EY Law or the EY team with whom you work.

Authors:

Veronika Juhasová

Kateřina Suchanová