Blog » A RECORD GDPR FINE OF HUF 100 MILLION – THE PRICE OF THE PROCRASTINATION
A RECORD GDPR FINE OF HUF 100 MILLION – THE PRICE OF THE PROCRASTINATION
17 June 2020
The Data Protection Authority imposed the highest fine ever in Hungary against Digi Távközlési és Szolgáltató Kft. because of the infringement of the GDPR. Let’s see what led to the record fine of HUF 100 Million.
DIGI learnt from an ethical hacker that on his webpage www.digi.hu certain test databases are available which contain the personal data of his clients and subscribers to his newsletter. The ethical hacker used a security loophole on the webpage in order to access to client data.
DIGI notified the Data Protection Authority about the data breach within 72 hours who started an investigation based on the notification.
However the decision published by the Data Protection Authority does not contain exact figures, it is certain that DIGI stored the personal data of a large number of data subjects and because of their detailedness the data records would enable identity theft or fraud.
2. Insufficient data security measurements
Based on the investigation the Data Protection Authority established that the data breach happened because DIGI did not implement data security measures to ensure a level of security appropriate to the risks.
On the one hand, the security loophole used by the ethical hacker has been known for 9 years and a bug fix was already available but DIGI did not install it because it was not the part of the official update-package.
On the other hand, DIGI did not use encryption in relation to the personal data contained by the test data although encryption as a necessary data security measure is specifically mentioned by the GDPR.
3. Infringement of data protection principles
As we speak, plane crashes usually happen because of more mistakes and that was also the case regarding DIGI’s data breach.
Besides the inappropriate data security measures, a basic problem was that the test databases should have been deleted a long time ago. Indeed, DIGI created the test databases for his client data to be available temporarily until he fixes the mistake in his systems which hinders the availability of the client data.
Since DIGI has not deleted the test database after the correction o the mistake that is to say after the personal data were no longer necessary for the purpose of the data processing, DIGI infringed the principles of “purpose limitation” and “storage limitation”.
4. Circumstances which influenced the amount of the fine
When imposing the record fine the Data protection Authority considered as aggravating circumstances among other the fact that the data breach was the consequence of data security loophole for which a free bug fix was available a long time ago and that the absence of the encryption increased the risk of a data breach. The Data Protection Authority has also taken into account that the data breach concerned several personal data of a large number of data subjects compared to the number of the population of Hungary.
The Data Protection Authority considered as a mitigating factor that he has not yet established any infringements regarding DIGI and that DIGI acknowledged that he should have already deleted the test databases.
The fact that DIGI notified the Data Protection Authority within the 72 hours’ deadline and that DIGI cooperated during the investigation was not taken into account as a mitigating factor since these are the legal obligations of any controller.
5. Lesson learnt
The most basic lesson of the case is that you should delete the obsolete data and databases right after the purpose of processing has disappeared.
Further it is important to pay attention to the data security measures. The kind of data protection measurements which shall be applicable is influenced by a lot of factors for example the quantity or the sensitivity of the processed personal data and the available resources.
Nevertheless, it is clear that in case a data security measure is necessary and the technical feasibility exists, the Data Protection Authority will not be tolerant if a data breach happens because the controller has not implemented those security measurements.
IS THE JUDGE BIASED BECAUSE OF UNFAVOURABLE JUDGMENT IN OTHER CASE?
Can a judge be disqualified from deciding the legal dispute on the grounds of bias if he has delivered a judgment unfavourable to the plaintiff in another case? Can a court be biased if the plaintiff has "challenged" a previous decision of the court before the European Court of Human Rights? In this article, we answer these questions by analysing a recent judgment of the Hungarian Supreme Court.Read more »
CAN INCOMPATIBLE WORKPLACE BEHAVIOUR BE A GROUND FOR DISMISSAL IN HUNGARY?
Refusal of employer 's instructions, unjustified absence, intentional damage: some cases where the justification for dismissing an employee is relatively easy to determine. What happens, however, if the employee does not commit a severe breach of duty similar to the one above, but his or her colleagues consider him incompatible, with whom it is impossible to cooperate, or even afraid of him or her. Can dismissal be justified by behaviour that is incompatible with others and creates disharmony in the working environment? In our article, we seek the answer to this question in the light of Hungarian judicial practice.Read more »
CAN A JUDICIAL ERROR CREATE HUNGARIAN JURISDICTION DESPITE A PLACE OF PERFORMANCE ABROAD?
Can a defendant, domiciled abroad, be sued in Hungary under the Brussels I Regulation in the event of defective performance of an international sales contract if the place of performance is abroad? Can the jurisdiction of a Hungarian court be established based on the fact that the lower court expressly established its jurisdiction at the beginning of the litigation? How is the EXW clause to be interpreted within the meaning of the Brussels I Regulation? In our article, we analyse the recent decision of the Supreme Court of Hungary.Read more »