Source: https://edpb.europa.eu/news/national-news/2018_en
Timestamp: 2019-04-26 07:08:17+00:00

Document:
The German supervisory authority LfDI Baden-Württemberg imposed the first fine in Germany under the GDPR. Due to a violation of Art. 32 GDPR (Security of Processing), a German social network operator was fined EUR 20.000 in September 2018.
The company had notified a data breach from July 2018 to the supervisory authority in accordance with Art. 33 GDPR, reporting that personal data of 330.000 users, such as e-mail addresses and passwords, had been hacked. The company fully cooperated and gave insights on internal structures, which showed that passwords had been stored unencrypted. The company thereby failed to grant data security according to Art. 32 (1) (a) GDPR. Due to its exemplary cooperation and readiness to follow all recommendations of the supervisory authority – also taking into account the total financial burden of the additional costs of implementation and the fine – the company was not fined higher.
Wegen eines Verstoßes gegen die nach Art. 32 DS-GVO vorgeschriebene Datensicherheit hat die Bußgeldstelle des LfDI Baden-Württemberg mit Bescheid vom 21.11.2018 gegen einen baden-württembergischen Social-Media-Anbieter eine Geldbuße von 20.000,- Euro verhängt und - in konstruktiver Zusammenarbeit mit dem Unternehmen - für umfangreiche Verbesserungen bei der Sicherheit der Nutzerdaten gesorgt.
For further information please contact the LfDI Baden-Württemberg (contact details above).
The Swedish Data Protection Authority has examined whether more than 350 companies and authorities have appointed a data protection officer. The audit shows, among other things, shortcomings in nearly a quarter of the unions selected for control.
According to the General Data Protection Regulation, GDPR, all authorities and also certain companies are obliged to designate a data protection officer. This person shall check that its own organization complies with data protection regulations, and inform and advise internally.
"It is a very important role when it comes to raising awareness and compliance with GDPR, which is why we prioritized this as our first GDPR review," says Inspector General Lena Lindgren Schelin.
The Swedish Data Protection Authority has conducted a broad review of more than 350 authorities and companies and has examined whether they appointed a data protection officer and, if they also have reported this to the Swedish Data Protection Authority, which they must do.
The audit shows that the majority of the organizations have notified and appointed a data protection officer in time. However, some sectors stand out in a negative way. Of the 51 unions included in the supervision, nearly 25 percent had deficiencies.
"The review was conducted shortly after GDPR came into effect on May 25th. Therefore we have not gone further than issuing reprimands. But, if in the future we continue to see shortcomings when it comes to appointing a data protection officer, fines will be on the table”, says Lena Lindgren Schelin.
On September 12th 2018, the Austrian DPA made its very first administrative penal decision for infringements of the GDPR and Austrian Data Protection Act.
The Austrian DPA imposed a fine on a Limited Liability Company which is running a sports betting café as the controller within the meaning of Article 4. 7 GDPR of an image processing system (video surveillance). The subject cameras have been in use at least since March 22nd 2018.
The controller has violated Art. 5 para. 1 lit. a and c as well as Art. 6 para. 1 of the General Data Protection Regulation (GDPR) and several provisions of the Austrian Data Protection Act (DSG).
Due to these administrative offences, the Limited Liability Company as a controller is imposed administrative fines to the total amount of € 5.280,00.
The infringements refer to the following: the video surveillance system covers public streets as well as parking lots, both part of the public area in front of the entrance of the sports betting café. This is not adequate for the purposes of the processing and is not limited to a necessary extent. There are no logs of video surveillance processing operations. There is no deletion of the personal image data recorded by the video surveillance within 72 hours and no separate logs for processing in this regard and a justification for an extended storage period is missing (as determined in the Austrian Data Protection Act). In Addition to that, the filmed area does not have adequate signage about CCTV.
The controller lodged a complaint with the Federal Administration Court against this decision.

References: Art. 32
 Art. 33
 Art. 32
 Art. 32
 Art. 5
 Art. 6