- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Hamburger Verkehrsverbund GmbH (HVV GmbH) – €20,000 Fine (Germany, 2019)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Hamburger Verkehrsverbund GmbH (HVV GmbH) was fined for failing to report a security gap on its website that exposed customer data. This delay in reporting violated privacy rules and could have put customer information at risk. It stresses the importance of timely reporting of data breaches.
What happened
HVV GmbH did not promptly report a security gap that allowed unauthorized access to customer data on its website.
Who was affected
Customers who logged into the HVV website and had their data potentially exposed due to the security issue.
What the authority found
The authority found that HVV GmbH failed to report a data breach in a timely manner, violating privacy regulations.
Why this matters
This ruling highlights the critical need for companies to act quickly when they discover data breaches. It serves as a reminder that timely reporting is essential to protect customer privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 13 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On July 6, 2018, HVV GmbH was informed by a customer about a security gap on the website www.hvv.de, which was caused by an update on February 5, 2018 and concerned the so-called Customer E-Service (CES). The security gap consisted in the fact that customers logged in to the CES who had an HVV Card and linked their CES customer account to at least one active contractual relationship in background systems could, by changing the URL, display data of other customers who had an HVV Card. This data breach was not reported to the data protection authority in a timely manner.
Related Enforcement Actions (0)
No other enforcement actions found for Hamburger Verkehrsverbund GmbH (HVV GmbH) in DE
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
1 January 2019
Authority
Bundesbeauftragter für den Datenschutz
Fine Amount
€20,000
Enforcement Tracker ID
ETid-204
About this data
Cite as: Cookie Fines. Hamburger Verkehrsverbund GmbH (HVV GmbH) - Germany (2019). Retrieved from cookiefines.eu
Last updated: