Istituto Nazionale Previdenza Sociale – Violation Found (Italy, 2024)

On March 31, 2020, INPS changed it CDN technology (Content Delivery Network is a system that uses servers located in different places to deliver web content quickly to users around the world) to handle a large number of people accessing its website at the same time, especially important during the high-demand times caused by the COVID-19 pandemic benefits. However, during the setup, it led to caching errors that allowed unauthorized access to personal data for about 30 minutes. Instead of just showing users their own information, the system ended up showing some user's personal information to others if they visited the website during that time period. This happened because some pages that contained sensitive information were not excluded from caching. On April 1, 2020, the new system went live, and almost immediately, it was discovered that the system allowed unauthorized access to claims applications. On the same day, INPS notified Garante regarding the CDN data breaches that occurred because of incorrect caching configurations that led to unauthorized access to personal data by displaying cached personal data to other users. This data breach involved personal details displayed on the INPS portal, such as tax codes, names, addresses, and email contacts, among other information. On April 2, 2020, another breach happened in the context of emergency measures during the pandemic, specifically around the application process for a babysitting service bonus that began on April 1, 2020. Due to the hurried implementation and simplified access measures (like a simplified PIN system), the application procedure did not adequately differentiate between different user types. As a result, some users were wrongly granted access levels typically reserved for authorized intermediaries (like patronages), allowing them to view, modify, or submit applications that contained personal data. On April 3, 2020, INPS published a notice about the data breach on their homepage and set up a dedicated email for breach reports to manage the situation and communicate with the public. On April 6, 2020, INPD notified Garante regarding the second data breaches that occurred. On May 14, 2020, Garante instructed the controller, INPD to notify affected individuals of the data breach. On July 8, 2020, INPS completed the notification process to the data subject potentially affected by the data breach. Garante found that INPS had not implemented adequate technical and organizational measures to ensure a level of security appropriate to the risk, violating Article 32 GDPR. Specifically, the misconfigurations in the CDN and the authorization system for the "Bonus Baby Sitting" procedure allowed unauthorized access to personal data. INPS underestimated the risks associated with the data breaches and their potential impact on the rights and freedoms of individuals and this misjudgment led to delays in notifying the affected parties, violating Article 5(1)(f) GDPR. Also, Garante identified that INPS did not promptly notify them or the individuals affected by the breaches, violating Article 33 and Article 34 GDPR. The breaches demonstrated a failure to comply with several GDPR principles, including the principles of data protection by design and by default, and the principle of ensuring the confidentiality and integrity of personal data, as determined in Article 25 and Article 5(1) GDPR. Although INPS took steps to address the breaches after they became known, Garante found these measures insufficient to mitigate the risks posed by the breaches effectively. Because of that, Garante issued a warning to INPS, acknowledging the extraordinary circumstances and the efforts made to address the issues. However, they emphasized that compliance with GDPR standards is mandatory, regardless of the situation at the hand. Garante highlighted that INPS shall adhere strictly to GDPR standards, particularly in relation to security, data breach notification, and overall compliance with data protection principles.