Unintentional posting of personal data at Covid-19 test center.
After a Covid-19 test center, reported an incident to the Hessian Commissioner for Data Protection and Freedom of Information in which an employee took an adhesive label out of the trash to write down the test center’s email address and then posted it, the commissioner responded. The label was placed on the shop window of the center, where it was visible to third parties. However, the employee did not notice that there was personal data on the label. After about 24 hours, the label was removed again.
Entscheidungsdatum:
31.12.2022
Land:
Germany
Art des Verstoßes:
Illegal data processing
Betroffene Datensätze:
1
Waren sensible Daten betroffen?:
Yes
verhängte Geldstrafe:
€ 1,800,-
Violation of GDPR Paragraph:
33. Notification of a personal data breach to the supervisory authority
6. Lawfulness of processing
Quelle:
Annual Report of the Hessian Commissioner for Data Protection and Freedom of Information