Enforcement · Information Commissioner (ICO) NL LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Advanced Computer Software Group Ltd: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen.

Een boete van 3.500.000 euro - Informatiecommissaris (ICO).

Een boete van 3.500.000 euro - Informatiecommissaris (ICO).

€3,500,000 Fine
Advanced Computer Software Group Ltd
UNITED KINGDOM
Insufficient technical and organisational measures to ensure information security
Art. 32 GDPR
Gezondheidszorg
Security Controllers Personal Data Health Data Healthcare
Mar 26, 2025 Source ico.org.uk

Full text

De Britse gegevensbeschermingsautoriteit (ICO) heeft Advanced Computer Software Group Ltd een boete van 3,07 miljoen pond (3,5 miljoen euro) opgelegd vanwege ontoereikende IT-beveiliging (schending van artikel 32(1) van de Britse AVG). De verantwoordelijke partij heeft nagelaten passende technische en organisatorische maatregelen te implementeren om persoonsgegevens te beschermen. Een ransomware-aanval in augustus 2022 stelde hackers in staat om toegang te krijgen tot de systemen van een dochteronderneming in de gezondheidszorg via een klantaccount dat geen multi-factor authenticatie had. Hierdoor waren de persoonsgegevens van 79.404 personen in gevaar.

AVG-artikelen: Artikel 32(1) AVG

Deze inhoud is automatisch vertaald met behulp van machinevertaling. De originele versie is beschikbaar in de brontaal.

How it connects

References

Related across sources

C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield Supervision IP Address
Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Guidelines ·EDPB Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design
C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… CJEU ·Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision
C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
439360 French Conseil d'État strikes down GendNotes police app decree for excessive special data In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile… CE Apr 13, 2021 Types of Special Categories of Personal Data Retention Period Personal Data
Opinion 04/2021 EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery Opinion Mar 31, 2021 Personal Data Privacy by Design & Default Accountability
Related documents