Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Brav s.r.l.: Insufficient technical and organisational measures to ensure information security

€10,000 Fine
Brav s.r.l.
ITALY
Art. 5 GDPR Art. 32 GDPR
Data Breaches Integrity and Confidentiality Principle Security Right of Access Controllers Privacy by Design & Default Processing Agreement Personal Data
Mar 24, 2022 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Guidance Opinion 7/2024 on the draft decision of the German North Rhine Westphalia Supervisory Authority regarding the EU Cloud Service Data Protection (Auditor) certification criteria EDPB Case Law VB v Natsionalna agentsia za prihodite CJEU Guidance EDPB Annual Report 2022 EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB

Full text

The Italian DPA has imposed a fine of EUR 10,000 on Brav s.r.l.. The operator of the online platform had reported a data breach to the DPA pursuant to Art. 33 GDPR. Unauthorized persons had managed to access the platform used by the Genoa Police for the management of traffic violations, as well as the personal data contained therein. According to the City of Genoa, it was possible to gain unauthorized access to the platform due to the fact that certain employees had unauthorizedly disclosed the password for accessing the platform, in violation of official regulations. For this reason, the DPA found that the controller had failed to take appropriate technical and organizational measures to protect personal data. The controller should have ensured that passwords were changed regularly to prevent unauthorized persons from gaining access to personal data.

Industry: Industry and Commerce

Original document at the source www.gpdp.it

Similar Content