Germany

Logistics company

—

GDPR enforcement action by Data Protection Authority of Hamburg on 2022.

Case details

Authority: Data Protection Authority of Hamburg
Date: 2022
Controller / Processor: Logistics company
Sector: Transportation and Energy
Quoted Articles: Art. 32 (1) GDPR, Art. 33 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

A logistics company had disposed of delivery lists in a public waste paper container. The lists contained a large amount of detailed information, such as the first and last names of subscribers, the addresses, subscribed newspapers, and special delivery information, such as the location of mailboxes and any complaints from recipients. The DPA also noted that the company failed to inform the data subjects and the DPA of the data breach in a timely manner.

Open original source Links to the regulator's original publication or another source.