Italy

Agenzia regionale protezione ambientale Campania (ARPAC)

8,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2021-01-14.

Rank · Sector

#197

of 357 in Public Sector and Education

Rank · Italy

#310

of 543

Rank · All fines

#1,502

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2021-01-14
Controller / Processor: Agenzia regionale protezione ambientale Campania (ARPAC)
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Italian DPA (Garante) imposed a fine of EUR 8,000 on the Regional Environmental Protection Agency of Campania (ARPAC). An external hard drive containing personal data had been stolen from the controller. Among other things, it contained copies of identity documents, tax records and payroll records. During the investigation, the DPA discovered that the hard drive had been located in a room to which all of the controller's employees had access. In addition, the controller did not back up the affected data, so it was irrevocably lost. Consequently, the DPA concluded that the controller violated the duty to implement appropriate technical and organizational measures to ensure the security of data processing.

Open original source Links to the regulator's original publication or another source.