Enforcement · Data Protection Commissioner of Malta EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

C-Planet (IT Solutions) Limited: Insufficient technical and organisational measures to ensure information security

€65,000 Fine
C-Planet (IT Solutions) Limited
MALTA
Art. 5 GDPR Art. 6 GDPR Art. 9 GDPR Art. 14 GDPR Art. 32 GDPR Art. 33 GDPR Art. 34 GDPR
Notification Obligation Data Breaches Security Processing Agreement Privacy by Design & Default Law Enforcement Controllers Personal Data
Jan 17, 2022 Source

How it connects

Related across sources

Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB

Full text

The DPA of Malta has imposed a fine of EUR 65,000 on C-Planet (IT Solutions) Limited. The DPA had initiated an investigation against C-Planet in April 2020 after being informed of a data breach. The DPA noted as a result that C-Planet had violated Art. 6 (1) GDPR, Art. 9 (1), (2) GDPR, Art. 14 GDPR and Art. 5 (1) f) GDPR in the context of data processing. The DPA also found that C-Planet failed to implement appropriate technical and organizational measures to ensure a level of security commensurate with the risk and that this led to the data breach. This constitutes a violation of Art. 32 GDPR. In addition, the DPA found that the controller failed to notify the personal data breach within the legally required deadline and to inform the data subjects. This constitutes a violation of Art. 33 GDPR and Art. 34 GDPR.

Industry: Industry and Commerce

Original document at the source idpc.org.mt

Similar Content