Skip to content
News·noyb - European Center for Digital RightsEN
Export

noyb files two complaints against EU Parliament over massive data breach

Data Security In early May 2024, the European Parliament informed its staff of a massive data breach in the institution’s recruiting platform (called “PEOPLE”).

Full text

Data Security In early May 2024, the European Parliament informed its staff of a massive data breach in the institution’s recruiting platform (called “PEOPLE”). The breach affected the personal data of more than 8,000 staff. This included ID cards and passports, criminal record extracts, residence documents and even sensitive data such as marriage certificates that reveal a person’s sexual orientation. The Parliament only found out about the breach months after it happened, and still doesn’t seem to know the cause. This is particularly worrying as the Parliament has long been aware of vulnerabilities in its cybersecurity system. EU institutions are naturally high up on the list of hackers and foreign adversaries. noyb has now lodged two complaints with the European Data Protection Supervisor on behalf of four parliament employees. Complaint against the European Parliament #1Complaint against the European Parliament #2The data of all applicants in one place. Before you can apply for a j

How it connects

C-77/21 Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság In this preliminary ruling, the CJEU interpreted Articles 5(1)(b) and 5(1)(e) GDPR in proceedings between Digi Távközlési és Szolgáltató Kft. and the Hungarian National Authority… CJEU ·First Chamber Oct 20, 2022 Retention Period Storage Limitation Personal Data
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Controllers Records of processing activities
C-182/22 JU and SO v Scalable Capital GmbH In Joined Cases C-182/22 and C-189/22, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Amtsgericht München concerning the… CJEU ·Third Chamber Jun 20, 2024 Liability Data Breaches Personal Data
Opinion 01/2025 EDPB- EDPS Joint Opinion 01/2025 on the Proposal for a Regulation on simplification measures for SMEs and SMCs, in particular the record-keeping obligation under Art. 30(5) GDPR De EDPB en EDPS steunen het doel om de administratieve lasten voor SMCs en MKB te verminderen, mits dit de bescherming van fundamentele rechten niet verlaagt. Ze benadrukken de… Opinion Jul 9, 2025 Records of processing activities Integrity and Confidentiality Principle Accountability