# Agenzia regionale protezione ambientale Campania (ARPAC): Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2021-01-14
- Original: https://www.enforcementtracker.com/ETid-556
- Canonical: https://overview.legal/posts/46671
- Topics: Security, Education, Controllers, Privacy by Design & Default, Personal Data, Public Authority, Processing Agreement, Public Sector, Supervisory Authorities, Processing

## Summary

The Italian DPA (Garante) imposed a fine of EUR 8,000 on the Regional Environmental Protection Agency of Campania (ARPAC). An external hard drive containing personal data had been stolen from the controller. Among other things, it contained copies of identity documents, tax records and payroll records. During the investigation, the DPA discovered that the hard drive had been located in a room to which all of the controller's employees had access. In addition, the controller did not back up the a

## Full text

The Italian DPA (Garante) imposed a fine of EUR 8,000 on the Regional Environmental Protection Agency of Campania (ARPAC). An external hard drive containing personal data had been stolen from the controller. Among other things, it contained copies of identity documents, tax records and payroll records. During the investigation, the DPA discovered that the hard drive had been located in a room to which all of the controller's employees had access. In addition, the controller did not back up the affected data, so it was irrevocably lost. Consequently, the DPA concluded that the controller violated the duty to implement appropriate technical and organizational measures to ensure the security of data processing.

GDPR Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/46671 · 2026-08-22