Kruidvat fined 600,000 euros for online privacy violation

The owner of the drugstore chain Kruidvat has been issued a fine of 600,000 euros for privacy breaches. The company monitored the internet behavior of visitors to the Kruidvat.nl site without these people's knowledge. This means that Kruidvat's holding company, AS Watson, processed this personal data illegally.

AS Watson made the error in 2020 while using tracking cookies,' The Dutch Data Protection Authority (AP) reported. Tracking cookies are pieces of code that can be used to see which other sites somebody is visiting on their computer. Kruidvat.nl used these cookies but did not alert visitors about this, which they are legally obligated to do, according to the regulator. The company also did not ask for permission to use the cookies. Kruidvat is currently following the rules regarding this.

In addition to information about the sites the people were visiting, the Kruidvat owner also had information about their location and the products they were adding to their digital shopping basket.

The privacy watchdog pointed out that information about search behavior on drugstore websites is often very sensitive. This is, for example, the case when customers search for pregnancy tests, contraceptives, or remedies for health problems.

AS Watson objected to the fine, according to the AP. "Let me say first that we are very surprised by this fine," said a spokesperson for the company. She would not go into detail about the company's objections to the fines because the objection procedure is still ongoing.

AS Watson also claimed that the period in which Kruidvat.nl broke the law with the cookies was relatively short. The Dutch Data Protection Authority first identified violations in April 2020, and they were stopped by October of that year. However, Watson also disputes that there was a violation during that period.

"Security of personal data and privacy are our top priorities," said the spokesperson of the Kruidvat owner.

The AP is checking more often whether websites are asking permission in the right way to use tracking cookies or other software meant for following people. The regulator said that the annoyance surrounding cookies and cookie notifications is increasing. This includes annoying banners but also concerns about tracking internet users.