Dutch DPA unable to collect € 525K fine due to unknown location transgressor

The Autoriteit Persoonsgegevens is incapable of collecting a fine it imposed on LocateFamily.com, because the Dutch data protection authority (DPA) doesn’t know where the company is located.

Back in May 2021, the Dutch DPA imposed a fine of € 525,000 on LocateFamily.com. Like nine other European DPAs, the supervisor from the Netherlands received dozens of complaints from people who had no idea how their names, addresses, phone numbers and other personal information ended up on the LocateFamily.com website, without their consent.

The site always claimed that the data was obtained from public sources, like social media, forums and blogs. Part of this information came from companies that collect and sell this data. The company’s website listed personal details from over 700,000 Dutch people. This information was accessible for everyone.

Furthermore, LocateFamily.com had an online removal tool, but despite this it wasn’t easy to delete personal information.

All things considered the Autoriteit Persoonsgegevens decided to impose a hefty fine for these GDPR violations. It also handed the company a penalty for not having a company representative in Europe. Till this very day none has been appointed.

It’s been over three years since the Dutch DPA laid down the fine, but the supervisor has never collected the money that was due.

“The company did not respond to our attempts to contact them and it’s unclear where the company is located, so sending a collecting agency is impossible,” a spokesperson of the Autoriteit Persoonsgegevens says to Tweakers.net.

Technical research showed that LocateFamily.com might possibly have its main office in Canada. The Dutch DPA got the European Data Protection Supervisor (EDPS), the Irish DPA and French supervisor involved. They contacted the Canadian Office of the Privacy Commissioner to learn who was hosting the company’s website, but to no avail.

“That’s the problem with a company that doesn’t have a representative in the European Economic Area (EEA): European regulators can’t just knock on their doors,” the spokesperson points out.

However, the Dutch DPA is looking into the possibility of still collecting the fine. For example, by investigating to see if management can be held liable personally.