Unintentional posting of personal data at Covid-19 test center.
After a Covid-19 test center, reported an incident to the Hessian Commissioner for Data Protection and Freedom of Information in which an employee took an adhesive label out of the trash to write down the test center’s email address and then posted it, the commissioner responded. The label was placed on the shop window of the center, where it was visible to third parties. However, the employee did not notice that there was personal data on the label. After about 24 hours, the label was removed again.
Art des Verstoßes:
Illegal data processing
Waren sensible Daten betroffen?:
Violation of GDPR Paragraph:
33. Notification of a personal data breach to the supervisory authority
6. Lawfulness of processing