Postel S.p.A. – €900,000 Fine (Italy, 2024)

The controller is a subsidiary of Poste Italiane, the main post services company of Italy. In August 2023, an unauthorised person accessed, through a ransomware cyberattack, the controller’s servers, containing data of the controller’s employees and job applicants (around 25,000 data subjects). These files, that were afterwards published online on the dark web, contained not only the name, surname and date of birth, but also data related to the trade union membership and health of the data subjects, therefore falling into the scope of Article 9 GDPR, and related to criminal convictions and offences (Article 10 GDPR). On 17 August 2023, the controller notified the data breach to the DPA. On 13 October 2023, the DPA requested the controller to provide further details about the data breach, arguing that the first notification was lacking some of the elements provided for by Article 33(3) GDPR. The controller pointed out that the data breach occurred due to two vulnerabilities in the IT system. First, the DPA held that the notification was lacking some of the elements provided for by Article 33(3) GDPR. The DPA pointed out that, also according to Recital 87 GDPR, the notification made to the DPA must contain adequate and exhaustive information concerning the data breach. According to the DPA, the purpose of such a notification is to allow the DPA to use its powers and restore a high level of protection of personal data. In the case at hand, for example, the notification was lacking any information about which servers were impacted and what vulnerabilities were used to access the system. Moreover, the controller did not refer to any measure taken to mitigate the data breach adverse effects, even though this would be required by Article 33(3)(d) GDPR. Therefore, the DPA found a violation of Article 33 GDPR. Second, the DPA noted that the data breach could happen due to two vulnerabilities present in the Microsoft Exchange platform, allowing the unauthorised third party to access the server and set themselves as an admin user. The DPA also pointed out that Microsoft had reported these vulnerabilities several months before the breach. The same had been done also by the Italian Cybersecurity Agency. However, the controller did not take any action to solve this problem. The DPA referred to the judgement of the CJEU in case C-340/21, Natsionalna agentsia za prihodite. On the one hand, the DPA pointed out that – as previously noted by the controller – the CJEU had ruled that the simple unauthorised access by a third party is not sufficient to hold that the technical and organisational measures were not appropriate (para. 39; see also C-687/21, MediaMarktSaturn, para. 40). On the other hand, the DPA noted that in the same judgement, the CJEU ruled that, since the level of protection provided for by the GDPR is dependent on the security measures adopted by controllers, the latter must be encouraged to do everything in their power to prevent the occurrence of data breaches (C-340/21, Natsionalna agentsia za prihodite, para. 55). According to the DPA, it is apparent that the controller did not do everything in its power, since the vulnerabilities were reported almost 12 months earlier. Therefore, the DPA found a violation of Article 5(1)(f), 25 and 32 GDPR. On these grounds, the DPA issued a fine of €900,000 and ordered the controller to implement internal procedures in order to timely detect and solve vulnerabilities in its IT system.