Sanction RGPD Data Protection Authority of Hamburg — Covid-19 test center : 3 k€ (2022)
- Autorité de contrôle
- Data Protection Authority of Hamburg
- Pays
- Allemagne
- Entreprise / secteur
- Covid-19 test center
- Montant de l'amende
- 3 k€
- Date de la décision
- 1 janvier 2022
- Fondement juridique
- Art. 32 (1)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The DPA of Hamburg has imposed a fine of EUR 2,700 on a Covid-19 test center. The test center had send the data subjects an unencrypted e-mail containing a URL that allowed them to access the test result without taking any further security measures. In some cases, the download link was structured in a way that led to the download of a PDF file with the file name corresponding to the last name of the person tested. With knowledge of the directory path, it was therefore possible to view third-party test results.