Company: Insufficient technical and organisational measures to ensure information security

The Belgian DPA has imposed a fine of EUR 2,500 on a company. The company operates a digital management platform where suppliers and customers can communicate and upload administrative documents. An individual, who is not themselves a member of the platform, had filed a complaint with the DPA. Since the complainant's roommate is a member of the platform, the complainant asked them to upload the joint water bill, which was in the complainant's name. The platform recognized the complainant's name and sent the roommate an invitation to connect with additional companies through the platform where the complainant was a customer. Although the roommate did not accept the invitation, they were able to view various data concerning the complainant. The DPA found that the company had failed to implement appropriate technical and organizational measures to protect personal data, in order, for example, to prevent easy access to third-party data.

GDPR Articles: Art. 5 (1) d) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 32 (1), (2) GDPR
Industry: Industry and Commerce