The Dutch data protection authority has imposed a fine of EUR 525,000 on a media company. Apparently, the company had demanded from data subjects as a condition of a data protection disclosure or data deletion a Proof of identity in the form of an identity document required.
As a result, in the view of the authority, the company had Too much data collected for identity verification purposes and the exercise of data subject rights too complicated made. In determining the amount of the fine, the authority had further taken into account the fact that the media company had not relied on the possibility of Blackening of data not required in the copies of the ID cards (cf. Media release).