Enforcement · Belgian Data Protection Authority (APD) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Company: Insufficient technical and organisational measures to ensure information security

€2,500 Fine
Company
BELGIUM
Art. 5 GDPR Art. 24 GDPR Art. 32 GDPR
Security Processing Agreement Human Resources Personal Data Privacy by Design & Default Law Enforcement Supervisory Authorities
Aug 23, 2022 Source

How it connects

Related across sources

Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News What Happened to the Risk-Based Approach to Data Transfers? Future of Privacy Forum News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet Guidance EDPB Annual Report 2021 EDPB

Full text

The Belgian DPA has imposed a fine of EUR 2,500 on a company. The company operates a digital management platform where suppliers and customers can communicate and upload administrative documents. An individual, who is not themselves a member of the platform, had filed a complaint with the DPA. Since the complainant's roommate is a member of the platform, the complainant asked them to upload the joint water bill, which was in the complainant's name. The platform recognized the complainant's name and sent the roommate an invitation to connect with additional companies through the platform where the complainant was a customer. Although the roommate did not accept the invitation, they were able to view various data concerning the complainant. The DPA found that the company had failed to implement appropriate technical and organizational measures to protect personal data, in order, for example, to prevent easy access to third-party data.

Industry: Industry and Commerce

Original document at the source edpb.europa.eu

Similar Content