Sanction RGPD Dutch Supervisory Authority for Data Protection (AP) — CP&A : 15 k€ (2020)
- Autorité de contrôle
- Dutch Supervisory Authority for Data Protection (AP)
- Pays
- Pays-Bas
- Entreprise / secteur
- CP&A
- Montant de l'amende
- 15 k€
- Date de la décision
- 24 mars 2020
- Fondement juridique
- Art. 9, Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Dutch DPA (AP) has imposed a fine of EUR 15,000 on CP&A. The controller had documented both the causes of illness and specific complaints of the data subjects as part of the recording of employee absences due to illness. The DPA found that this was unlawful since health data is granted special protection. Employers are not permitted to record either the reasons or causes of sick leave. Furthermore, the DPA found that the controller had not implemented adequate technical and organizational measures to protect the processing when recording absences. Namely, the absence registration was accessible online, without any form of authentication. Yet, when an absence system is accessible via the Internet, the system is to be accessed only through a multi-factor authentication. In the DPA's view, another form of authentication would have been required in addition to the 'normal' login.