Germany
Aid organization
GDPR enforcement action by Data Protection Authority of Brandenburg on 2022.
Case details
- Authority
- Data Protection Authority of Brandenburg
- Date
- 2022
- Controller / Processor
- Aid organization
- Sector
- Individuals and Private Associations
- Quoted Articles
- Art. 28 (3) GDPR, Art. 32 GDPR
- Type of violation
- Insufficient technical and organisational measures to ensure information security
Summary
The DPA of Brandenburg has imposed a five-figure fine on an aid organization. The aid organization provides transportation for people with illnesses. The organization had reported a data breach to the DPA in which data of data subjects had been published due to a hack. At the time of the attack, the controller's database contained more than 80,000 records with data that included information about the health status of the data subjects. During its investigation, the DPA found that the bank had failed to take adequate technical and organizational measures to protect personal data, which allowed such a breach to occur. In addition, the DPA found that the bank had failed to conclude a processing agreement with its processors.
Related fines