Sanction RGPD Italian Data Protection Authority (Garante) — Agenzia regionale protezione ambientale Campania (ARPAC) : 8 k€ (2021)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Agenzia regionale protezione ambientale Campania (ARPAC)
- Montant de l'amende
- 8 k€
- Date de la décision
- 14 janvier 2021
- Fondement juridique
- Art. 5 (1) f), Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Italian DPA (Garante) imposed a fine of EUR 8,000 on the Regional Environmental Protection Agency of Campania (ARPAC). An external hard drive containing personal data had been stolen from the controller. Among other things, it contained copies of identity documents, tax records and payroll records. During the investigation, the DPA discovered that the hard drive had been located in a room to which all of the controller's employees had access. In addition, the controller did not back up the affected data, so it was irrevocably lost. Consequently, the DPA concluded that the controller violated the duty to implement appropriate technical and organizational measures to ensure the security of data processing.