FIN, spol s.r.o.
- Country
- Slovakia
- Fine
- 7,000 EUR
- Date
- 22.05.19(22.05.19)
- Sector
- Company engaged in the manufacture and sale of confectionery, bakery and other products
- Articles
- Art. 5 par. 1 letter f) GDPRArt. 33 GDPR
The controller violated the principle of confidentiality by unauthorized processing and access to the personal data of the data subjects.
The controller violated the principle of confidentiality because in January 2019, the controller was disposing the personal data of the data subjects in paper form (such as photocopies of loan agreements, official documents such as ID card, birth certificate, passport), during liquidation of his store Elektro and the removal of waste to the collection yard in the village of Strečno, there was unauthorized processing and access to the personal data, which violated the security of the processing of personal data of the data subjects. The controller has not complied with its obligation to report the breach to the Authority without undue delay and, if possible, within 72 hours, in accordance with Article 33 of the GDPR.
Additional information
On February 5, 2019, the Authority received an e-mail from a person who was to find the accounts of the company FIN, spol. s.r.o. During a quick review of discarded documents, he discovered, among other things, the company's contracts with citizens, while these contracts contained personal data of citizens, their clients, including their birth numbers.<br /><br />Measures:<br />The Authority has imposed on the controller a measure pursuant to which the controller is obliged in accordance with Art. 32 The GDPR, to take appropriate organizational measures to determine the procedure for persons acting on his behalf (employees) in checking unnecessary paper documents and disposing of personal data on them, instructing them of the procedure.
Reported by: Advokáti Chlipala s.r.o.