Enforcement · Data Protection Commision of Bulgaria (KZLD) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

L.E. EOOD: Insufficient technical and organisational measures to ensure information security

€2,560 Fine
L.E. EOOD
BULGARIA
Art. 25 GDPR Art. 32 GDPR Art. 6 GDPR
Integrity and Confidentiality Principle Security Personal Data Processing IP Address Privacy by Design & Default Consent
Feb 20, 2020 Source

How it connects

Related across sources

Case Law OLG München - 36 U 1054/25 e Higher Regional Court Munich Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Case Law VB v Natsionalna agentsia za prihodite CJEU Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB

Full text

The fine of ca EUR 2,557 was imposed on L.E. EOOD for unlawful processing of personal data of data subject I.S. without the knowing and the consent of the data subject and also without a valid contractual relationship between L.E. EOOD and I.S. The enterprise processed the personal data of I.S. unlawfully seven times in duration of 3 months by failure to adopt technical and organizational measures to ensure the information security. In addition to the fine, the Commission for Personal Data Protection (“KZLD”) instructed L.E. EOOD to do regular inspections of its data processing activities, to do risk analysis regarding customers and employees and to conduct periodic trainings of the employees. The KZLD also ordered L.E. EOOD to archive and keep the documents containing the personal data only for limited purposes and the timeframe as required by law.

Industry: Industry and Commerce

Original document at the source www.cpdp.bg

Similar Content