Ireland

VIEC Limited

100,000 €

GDPR enforcement action by Data Protection Authority of Ireland on 2022-12-22.

Rank · Sector

#75

of 595 in Industry and Commerce

Rank · Ireland

#21

of 36

Rank · All fines

#471

of 3,042

Case details

Authority: Data Protection Authority of Ireland
Date: 2022-12-22
Controller / Processor: VIEC Limited
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 (1) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Irish DPA has imposed a fine of EUR 100,000 on the nursing home operator VIEC Limited.
The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. The controller had suffered a phishing attack in which an unauthorized third party gained access to an email account of a VIEC manager. As a result, the unknown third party also managed to access personal data such as health and biometric data of home residents. The DPA found this to be a breach of the principle of integrity and confidentiality. The DPA also found that the controller had failed to implement appropriate technical and organizational measures to protect personal data.

Open original source Links to the regulator's original publication or another source.