Menu

Filter by
content
PONT Data&Privacy

0

Fine PVV Overijssel for failure to report data breach

The Autoriteit Persoonsgegevens (AP) is fining the Party for Freedom (PVV) Overijssel 7,500 euros. The PVV Overijssel is receiving this fine because the party failed to report a data leak to the AP. Because of this data leak, people's political opinions were leaked.

11 May 2021

 
The data breach arose via an e-mail about a constituency meeting. In it, 101 recipients were referred to as "friends of the PVV. Due to an error by a group employee, the e-mail addresses (and thus mostly the names) of the addressees were visible to everyone who received the invitation. As a result, the political views of the addressees were shared.

Complaint

The data breach came to the AP's attention after one of the addressees filed a complaint with the AP about the privacy violation. It then turned out that PVV Overijssel had not adequately dealt with this data leak by timely reporting it to the AP. That is a serious violation, especially given the sensitivity of the leaked information.

Extra protected

A person's political views are given extra protection in the General Data Protection Regulation (GDPR). They are so-called special personal data. Because this is sensitive information that is very private and that a person may keep to himself, stricter rules apply to the processing of this data.

Risk

If the confidentiality of this sensitive information is breached, it can put someone at great risk. It can lead to discrimination, for example. And affect someone's existing or future social position.

Great responsibility

Thus, by definition, a political organization processes sensitive information. Therefore, political organizations have a great responsibility to maintain a high level of protection. And to act adequately if, despite security measures in place, there is still a data breach.

Duty to report data breaches

In the event of a serious data breach, a notification obligation applies. This mandatory data breach notification means that both companies and governments must immediately (and in principle within 72 hours at the latest) notify the AP. It is essential that an organization report a data breach to the AP immediately. The AP can then help that organization limit the damage to the people affected. This includes providing instructions on how to plug the leak quickly and prevent future data breaches. The AP can also instruct the organization to quickly inform the victims of the leak. So as soon as PVV Overijssel knew about the data leak, the party should have reported it to the AP within 72 hours. But this did not happen. The PVV Overijssel does indicate that it has taken measures to prevent such a data leak in the future.

Share article

Comments

Leave a comment

You must be logged in to post a comment.