Sanction RGPD Belgian Data Protection Authority (APD) — Financial company : 100 k€ (2021)
- Autorité de contrôle
- Belgian Data Protection Authority (APD)
- Pays
- Belgique
- Entreprise / secteur
- Financial company
- Montant de l'amende
- 100 k€
- Date de la décision
- 26 avril 2021
- Fondement juridique
- Art. 5 (1) f), Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Belgian DPA (APD) has imposed a fine of EUR 100,000 on a financial company. A data subject had filed two complaints with the APD against the company. They were based on 20 queries of her personal data from the credit register of the National Bank of Belgium. The controller employs the data subject's ex-husband, who allegedly used his role to unlawfully gain access to the register in order to obtain financial information about the data subject and thus gain an advantage in their divorce proceedings. As the DPA noted, the data protection violations occurred due to the fact that the controller had not taken adequate organizational measures to protect personal data from unauthorized processing.