Croatia
Telecommunications company
GDPR enforcement action by Croatian Data Protection Authority (azop) on 2022-07-21.
Case details
- Authority
- Croatian Data Protection Authority (azop)
- Date
- 2022-07-21
- Controller / Processor
- Telecommunications company
- Sector
- Media, Telecoms and Broadcasting
- Quoted Articles
- Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (2) GDPR
- Type of violation
- Insufficient technical and organisational measures to ensure information security
Summary
The Croatian DPA has fined a telecommunications company EUR 285,000. The company had suffered a data breach. Attackers had managed to access data from about 100,000 data subjects.
During its investigation, the DPA found that such a breach was facilitated by the company's failure to implement adequate technical and organizational security measures for the processing of personal data. For example, the processing systems lacked access restrictions.
In assessing the fine, it was taken into aggravating account that the company is one of the leading telecommunications companies in Croatia and therefore, due to the high volume of data processed there, the risk of an attack on the systems was to be expected.
For this very reason, the company should have paid more attention to ensuring that sufficient safety measures were taken.
Related fines