Belgium

Company

2,500 €

GDPR enforcement action by Belgian Data Protection Authority (APD) on 2022-08-23.

Rank · Sector

#406

of 597 in Industry and Commerce

Rank · Belgium

#41

of 50

Rank · All fines

#2,177

of 3,050

Case details

Authority: Belgian Data Protection Authority (APD)
Date: 2022-08-23
Controller / Processor: Company
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) d) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Belgian DPA has imposed a fine of EUR 2,500 on a company. The company operates a digital management platform where suppliers and customers can communicate and upload administrative documents. An individual, who is not themselves a member of the platform, had filed a complaint with the DPA. Since the complainant's roommate is a member of the platform, the complainant asked them to upload the joint water bill, which was in the complainant's name. The platform recognized the complainant's name and sent the roommate an invitation to connect with additional companies through the platform where the complainant was a customer. Although the roommate did not accept the invitation, they were able to view various data concerning the complainant. The DPA found that the company had failed to implement appropriate technical and organizational measures to protect personal data, in order, for example, to prevent easy access to third-party data.

Open original source Links to the regulator's original publication or another source.