Groupon Ireland Operations Limited

DPC (Ireland) case IN-20-37-1, decided 2024-03-08. No monetary penalty (reprimand or guidance).

What the regulator decided

Groupon demanded photographic government-issued identification to verify the identity of a complainant who had requested access and erasure, despite less intrusive alternatives being available, breaching the data-minimisation principle in Article 5(1)(c) GDPR; Groupon also continued to process the complainant's personal data after the erasure request without a valid Article 6(1) basis, breaching Article 17(1) GDPR.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2024-06/Final-Decision-Groupon-International-Limited-March-2024-EN.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Reprimand under Article 58(2)(b) GDPR; no administrative fine. Cite alongside the Twitter IN-19-6-1 reprimand for the principle that identity verification must be proportionate - a controller cannot collect more personal data than necessary as a precondition to honouring an Article 15 or Article 17 request.

Verification trail

Verified by: donal
Verified at: 2026-05-27
Review due: 2026-11-27

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-dpc-in-20-37-1,
  author       = {{ConsentMark}},
  year         = {2024},
  title        = {DPC (Ireland) IN-20-37-1 - Groupon Ireland Operations Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-20-37-1}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2024, March 8). DPC (Ireland) IN-20-37-1 - Groupon Ireland Operations Limited. Methodology v1.3. https://www.consentmark.com/precedent/dpc-in-20-37-1

Markdown

[DPC (Ireland) IN-20-37-1 - Groupon Ireland Operations Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-20-37-1)

Plain text

DPC (Ireland) IN-20-37-1 - Groupon Ireland Operations Limited - ConsentMark, 2024-03-08, methodology v1.3, https://www.consentmark.com/precedent/dpc-in-20-37-1