Category: DPA actions

Posted on

CNIL fines SERGIC 400,000 EUR (web site vulnerability)

Very interesting case, that needs some closer analysis.

The fine is about 0.9% of SERGIC’s annual turnover in 2017.

During the on-line audit of September 7, 2018, CNIL agents retrieved files accessible from URLs composed as follows:
https: //www.crm.sergic .com / documents / upload / eresa / X.pdf
– where by changing X you could access another persons’s file.

SERGIC tries to argue that they shouldn’t have done that, etc.. – to no avail. CNIL observes that exploiting vulnerability does not require any particular technical expertise in computer science. CNIL also consider that the use of a script does not require any advanced skills to exploit this vulnerability.

(Should be good week-end reading.)

https://www.legifrance.gouv.fr/affichCnil.do?id=CNILTEXT000038552658

Posted on

First GDPR fine in Poland (~220,000 EUR) for failure to meet information obligation

  • Data subjects’ data obtained from publicly available sources, inter alia from the Central Electronic Register and Information on Economic Activity, and processed the data for commercial purposes.
  • Company did not meet the information obligation in relation to over 6 million people.
  • Out of about 90,000 people who were informed about the processing by the company, more than 12,000 objected to the processing of their data.
  • Some additional comments by Piotr Foitzik (IAPP forum on LinkedIn): The company also processed data of millions of people who were sole traders in the past and are not anymore. When it will send postal letters to postal addresses which are not correct and are outdated, this will result in a data breach. The fact that a legal basis has not been analyzed, and were it to be a legitimate interest a balancing test would need to be conducted, does not mean that processing was legitimate but that unfortunately the authority did not discuss some of the core issues here. All in all, publicly available information, including that of entrepreneurs is also subject to the GDPR and in this instance the data became public not as their free choice, but as it is a legal requirement in Poland, but this requirement also serves for specific purposes and the processing should be in line with these purposes

https://edpb.europa.eu/news/national-news/2019/first-fine-imposed-president-personal-data-protection-office_en

Posted on

ICO: Grove – ICO fines company GBP 40,000 for sending nearly two million direct marketing emails without consent

Grove, a Kent pensions company, which relied on ‘misleading’ professional advice has been fined £40,000 by the Information Commissioner’s Office for being responsible for sending nearly two million direct marketing emails without consent. Grove utilised the servie of a third party marketing agent to carry out a range of marketing functions on their behalf, including lead generation.

Grove, by extension through this marketing agent, would work with “email providers”, who essentially provided a hosted marketing service by sending out “pre-approved emails” to opted-in subscribers contained within data sets which they themselves supplied.

Mitigating factors (that helped reduce the penalty):

1) “extensive consultation” with a recognized specialist data protection consultancy (even though this advise was obviously not quite right) as demonstrated awareness of obligations and a generally positive and http://pro.active  approach to data protection

2) Number of complaints received was minimal.

3) No evidence that activity continued beyond period set out within the Notice

4) Cooperation with ICO investigation

https://ico.org.uk/media/action-weve-taken/mpns/2614585/grove-pensions-mpn-20190326.pdf