Dutch DPA imposes fine of €525,000 on Locatefamily.com
The Dutch Data Protection Authority (DPA) has imposed a fine of €525,000 on the website Locatefamily.com, which publishes people's addresses and phone numbers, often without their knowledge. Anyone who wants to have their details removed from the site cannot do so easily because Locatefamily.com does not have a representative in the EU. The lack of a representative in the EU is a breach of the General Data Protection Regulation (GDPR) and is the reason the fine was imposed.
To compel Locatefamily.com to establish a representative in the EU, the DPA has also imposed an order subject to penalty on Locatefamily.com. The company had to designate a representative in the EU by March 18 2021. Otherwise, Locatefamily.com must pay 20,000 euros for every 2 weeks it does not have such a representative, with a maximum of 120,000 euros. Locatefamily.com has not confirmed to the AP at this time whether it has now appointed a representative in the EU.
Uninvited visitors
The Dutch DPA has received dozens of complaints about Locatefamily.com. The website displays the full addresses and sometimes also the telephone numbers of people who are unaware of how their details came to appear there. They themselves did not, in any case, provide the site with their information.
This all has a significant impact on those people whose details appear on Locatefamily.com. Individuals who are unaware that their contact details have been made public could find themselves surprised by uninvited visitors at their door.
‘Private information must remain private’
‘For a website to publish your phone number and address without your knowledge is unacceptable,’ says DPA deputy chair Monique Verdier. ‘Private information must remain private. Wrongdoers could use this type of information to commit identity fraud, for example, or harass you at your home or by phone or email.’
‘You can certainly share this information if you want to, but this should be your choice to make. With Locatefamily.com, many people aren’t given that choice. And if your address and phone number do end up on this site, there must be an easy way to have that information removed. That’s not possible here, partly because Locatefamily.com does not have a representative in the EU. That's why we issued the website with a fine.’
No representative in the EU
Organisations that offer goods or services in the EU must have a representative to which EU citizens can turn for information or to exercise their privacy rights. Locatefamily.com has no such representative.
The Dutch DPA has mediated on behalf of people wishing to have their personal data removed from the website. In most cases, Locatefamily.com has since removed the data of the people in question.
700,000 Dutch people listed
Locatefamily.com is a platform where people can search for the contact information of family members with whom they have lost contact or of other people they would like to get in touch with.
The platform provides the personal details of people around the world, including in the EU. Approximately 700,000 Dutch people are listed on the site.
The site and all of the personal details on it are freely accessible to anyone. Locatefamily.com compiles lists without data subjects having to be a member of the platform or needing to create an account.
International investigation
Locatefamily.com is an international website. Other European regulators have also received complaints about the company. That is why the DPA worked with nine other European privacy supervisory authorities and with the Office of the Privacy Commissioner of Canada to investigate the website.
