A controller was sanctioned because he had unlawfully processed the personal data (CNP), and images of employees obtained through the surveillance system. The disclosure of the CNP in a report for the ISCIR training in 2018 wasn’t legal, as per Art.6 GDPR.
a controller was sanctioned because he had unlawfully processed the personal data cnp and images of employees obtained through the surveillance system the disclosure of the cnp in a report for the iscir training in wasn’t legal as per  
 controller  sanction    unlawfully process  personal data cnp  image  employees obtain   surveillance system  disclosure   cnp   report   iscir train  ’ legal  per  