# Insurance company: Insufficient fulfilment of data subjects rights

- Type: Enforcement
- Source: Information and Data Protection Commissioner (IDPC)
- Date: 2026-05-04
- Original: https://www.enforcementtracker.com/ETid-3405
- Canonical: https://overview.legal/posts/607215
- Topics: Personal Data, Accountability, Insurance, Supervision

## Summary

The Malta Information and Data Protection Commissioner (IDPC) fined an unnamed insurance company €1,000 for insufficient fulfilment of data subjects' rights, citing violations of Article 5(2) and Article 21(2) GDPR. The enforcement action concerned the insurer's failure to adequately comply with its accountability obligations and its duty to properly handle data subjects' requests to object to processing.

## Full text

Information and Data Protection Commissioner (IDPC) fined Insurance company €1,000 on 2026-05-04 for: Insufficient fulfilment of data subjects rights.
GDPR Articles: Art. 5 (2) GDPR, Art. 21 (2) GDPR
Sector: Finance, Insurance and Consulting
Country: Malta
Source: https://idpc.org.mt/wp-content/uploads/2026/05/0583_001.pdf

## Cited law provisions (4)

### GDPR — gdpr-art-5-par-2-en

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

### GDPR — gdpr-art-21-par-2-en

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-21-en

Right to object

---
Generated by overview.legal · https://overview.legal/posts/607215 · 2026-11-14