Postel S.p.A: Insufficient technical and organisational measures to ensure information security

The Italian DPA has imposed a fine of EUR 900,000 on Postel S.p.A. The company suffered a ransomware attack that resulted in the loss of access to files containing personal data of approximately 25,000 individuals. Data subjects included employees, former employees, and job applicants. The compromised data included contact details, identification details, payment details, and criminal records (special category data) of the data subjects. Although the company had been aware of the security vulnerability (following a report from the software manufacturer), it had not updated its systems. For this reason, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data in order to prevent such an incident. Furthermore, the company failed to provide the DPA with sufficient information on the incident.

GDPR Articles: Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR
Industry: Not assigned