Company – €65,000 Fine (Germany, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A company in Germany was fined EUR 65,000 because it used an outdated web store application with security flaws. The app was not receiving updates, and the company failed to secure stored passwords properly. This case highlights the importance of keeping software up-to-date to protect customer data.
What happened
A company used an outdated web store application with known security vulnerabilities and insufficient password protection.
Who was affected
Customers whose data was stored in the company's insecure web store application.
What the authority found
The authority found that the company did not take adequate technical measures to protect personal data, violating GDPR's security requirements.
Why this matters
This case emphasizes the need for businesses to regularly update their software and ensure strong data protection measures. It serves as a reminder that outdated systems can lead to significant fines and data breaches.
GDPR Articles Cited
The DPA of Lower Saxony has imposed a fine of EUR 65,000 on a company. The reason for the proceedings was a report by the company to the authority regarding a data breach pursuant to Art. 33 GDPR. As a result, the DPA conducted an audit of the company's web presence. In the process, the DPA discovered that an outdated web store application was used on the site, which was no longer provided with security updates. The developer had explicitly warned against further use of this version, as it contained significant security vulnerabilities. The investigations of the DPA further revealed that the passwords stored in the database were not sufficiently secured. The DPA concluded that the technical measures taken by the responsible party were not adequate for the protection requirements of the GDPR, resulting in a violation of Art. 32 GDPR.
Related Enforcement Actions (20)
Other enforcement actions involving Company in DE
Fine
€65K
Details
Fine Date
1 January 2020
Authority
Bundesbeauftragter für den Datenschutz
Fine Amount
€65,000
Enforcement Tracker ID
ETid-791
About this data
Cite as: Cookie Fines. Company - Germany (2020). Retrieved from cookiefines.eu
Last updated: