Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Postel S.p.A: Insufficient technical and organisational measures to ensure information security

€900,000 Fine
Postel S.p.A
ITALY
Art. 5 GDPR Art. 25 GDPR Art. 32 GDPR Art. 33 GDPR
Criminal Data Security Health Data Healthcare Personal Data Privacy by Design & Default Controllers Processing Agreement
Jul 4, 2024 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Guidance EDPB Annual Report 2019 EDPB Case Law GC and Others v CNIL CJEU Guidance Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 EDPB Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review

Full text

The Italian DPA has imposed a fine of EUR 900,000 on Postel S.p.A. The company suffered a ransomware attack that resulted in the loss of access to files containing personal data of approximately 25,000 individuals. Data subjects included employees, former employees, and job applicants. The compromised data included contact details, identification details, payment details, and criminal records (special category data) of the data subjects. Although the company had been aware of the security vulnerability (following a report from the software manufacturer), it had not updated its systems. For this reason, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data in order to prevent such an incident. Furthermore, the company failed to provide the DPA with sufficient information on the incident.

Industry: Not assigned

Original document at the source www.garanteprivacy.it

Similar Content