ACTIVE ASSURANCES (car insurer)
- Country
- France
- Fine
- 180,000 EUR
- Date
- 2019-07-25
- Sector
- Business Sector
- Articles
- Art. 32 GDPR
Insufficient technical and organisational measures to ensure information security
A large number of customer accounts, customer documents (including copies of driving licences, vehicle registrations, bank statements and documents) to determine whether a person's driving licence had been withdrawn and other personal data were easily accessible online. The CNIL criticised password management (unauthorised access was possible without any authentication). Authority: French Data Protection Authority (CNIL)
Source: https://www.legifrance.gouv.fr/affichCnil.do?id=CNILTEXT000038810992
Reported by: Alain Bensoussan Avocats Lexing