the Municipality of Alimos

What happened

The DPA fined a municipality €15,000 for a lack of technical and organizational security measures that led to the unauthorised availability of personal data on the municipality’s website. The municipality’s processor was fined €5,000.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(f)Read →
• Art. 25Data protection by design and by default25(1)Read →
• Art. 28Processor28(3)Read →
• Art. 32Security of processing32(1)Read →
• Art. 33Notification of a personal data breach to the supervisory authority33(4)Read →
• Art. 34Communication of a personal data breach to the data subject34(1) · 34(2)Read →

• Accountability
• Data breach
• Data principles
• Data security
• Processor obligations