The Netherlands

CP&A

15,000 €

GDPR enforcement action by Dutch Supervisory Authority for Data Protection (AP) on 2020-03-24.

Rank · Sector

#77

of 213 in Employment

Rank · The Netherlands

#40

of 43

Rank · All fines

#1,179

of 3,042

Case details

Authority: Dutch Supervisory Authority for Data Protection (AP)
Date: 2020-03-24
Controller / Processor: CP&A
Sector: Employment
Quoted Articles: Art. 9 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Dutch DPA (AP) has imposed a fine of EUR 15,000 on CP&A.
The controller had documented both the causes of illness and specific complaints of the data subjects as part of the recording of employee absences due to illness. The DPA found that this was unlawful since health data is granted special protection. Employers are not permitted to record either the reasons or causes of sick leave.
Furthermore, the DPA found that the controller had not implemented adequate technical and organizational measures to protect the processing when recording absences. Namely, the absence registration was accessible online, without any form of authentication. Yet, when an absence system is accessible via the Internet, the system is to be accessed only through a multi-factor authentication. In the DPA's view, another form of authentication would have been required in addition to the "normal" login.

Open original source Links to the regulator's original publication or another source.