Elgiganten A/S

What happened

The Danish DPA reprimanded a consumer electronics retailer for violating Article 32(1) GDPR by not deleting personal data on a used TV or storing the TV sufficiently securely before such deletion, which enabled access to the data by an unauthorised third party.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 4Definitions4(12)Read →
• Art. 32Security of processing32(1)Read →

• Data security