Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Agenzia regionale protezione ambientale Campania (ARPAC): Insufficient technical and organisational measures to ensure information security

€8,000 Fine
Agenzia regionale protezione ambientale Campania (ARPAC)
ITALY
Art. 5 GDPR Art. 32 GDPR
Security Education Controllers Privacy by Design & Default Personal Data Public Authority Processing Agreement Public Sector
Jan 14, 2021 Source

How it connects

Related across sources

News What Happened to the Risk-Based Approach to Data Transfers? Future of Privacy Forum Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB Guidance EDPB Annual Report 2021 EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU

Full text

The Italian DPA (Garante) imposed a fine of EUR 8,000 on the Regional Environmental Protection Agency of Campania (ARPAC). An external hard drive containing personal data had been stolen from the controller. Among other things, it contained copies of identity documents, tax records and payroll records. During the investigation, the DPA discovered that the hard drive had been located in a room to which all of the controller's employees had access. In addition, the controller did not back up the affected data, so it was irrevocably lost. Consequently, the DPA concluded that the controller violated the duty to implement appropriate technical and organizational measures to ensure the security of data processing.

Industry: Public Sector and Education

Original document at the source www.garanteprivacy.it

Similar Content