GDPR fine against Rousseau

GDPR fine against Rousseau

The right-wing populist party “5-star movement” operates the platform Rousseau in Italy. Due to insufficient technical security measurements, the data processor was fined € 50.000,-.

Prehistory

The political party operates the Rousseau Internet platform, where registered users were able to designate, among others, candidates for the upcoming EU parliamentary election. The platform is provided by the Rousseau company.

In the summer of 2017, this website was the target of a cyberattack.

The Italian data protection authority “Garante” found a multiple violations of the GDPR:

• It lacked a system to enforce strong user passwords. As a result, so-called brute-force attacks were easy to carry out.
• The platform did not use digital certificates in all parts of the website, so the data transfer between platform and users was not encrypted and therefore readable for unauthorized persons.
• The system administrators shared accounts. Furthermore, the rights were not assigned according to a scheme, which meant that too many people had access to personal data.
• Access to personal data has not been logged, so it can not be determined if data has been deleted, altered or downloaded. Therefore, it is not clear how many records were stolen.
• The software used was no longer supported by the developers, so necessary updates were cumbersome or not possible
• The cryptographic functions of the software were outdated, which made it easier to calculate the user passwords etc.

Decision of the Data Protection Authority

The Authority considered these deficiencies as an infringement of Article 32 of the GDPR (safety of processing) Article 32 of the GDPR (safety of processing) and imposed a fine of € 50,000.00. Article 32 of GDPR (Security of processing)

The outstanding is that this fine was not imposed against the 5-star movement but against the operating company of the Rousseau platform. While the party acts as controller under GDPR, the Rousseau company is only the processor. What impact these decisions will have will show the future.

It is also worth noting that the original incident took place before GDPR was taking effect. But the data protection authority fined the company under GDPR and argued that the technical deficiencies still persisted after 25 May 2018.

Conclusion

To make your processing state-of-the-art, a lot of knowledge is needed. easyGDPR gives you a simple way to benefit from expert knowledge. The Quickcheck gives you a precise overview about your current technical and organizational measures (TOM). Beside from that, you receive recommendations to make your data processing state-of-the-art and get your company GDPR-ready. The easyGDPR Quichcheck is part of every easyGDPR licence (lite, standard, enterprise) but can also be bought independently.

Entscheidungsdatum:
17.04.2019

Land:
Italy

Art des Verstoßes:
technical deficiency

Betroffene Datensätze:
unknown

Waren sensible Daten betroffen?:
No

verhängte Geldstrafe:
€ 50,000,-

Quelle: