Hungary

Digi Távközlési Szolgáltató Kft. ("Digi") (electronic communication service provider)

288,000 €

GDPR enforcement action by Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) on 2020-06-12.

Rank · Sector

#72

of 366 in Media, Telecoms and Broadcasting

Rank · Hungary

of 73

Rank · All fines

#305

of 3,042

Case details

Authority: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)
Date: 2020-06-12
Controller / Processor: Digi Távközlési Szolgáltató Kft. ("Digi") (electronic communication service provider)
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The company had infringed the principles of purpose limitation and storage restriction because its database contained a large amount of customer data which were no longer relevant for the actual purpose of collection and for which no retention period had been set. Furthermore, the NAIH pointed out that the defendant had not taken proportionate measures to reduce the risks in the area of data management and data security, arguing, inter alia, that it had not used encryption mechanisms.

Open original source Links to the regulator's original publication or another source.