- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2019-441-3399 – Violation Found (Denmark, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
BroBizz, a Danish company that handles automatic payments for bridges and ferries, faced criticism for not properly securing personal data. The data protection authority found that BroBizz failed to protect the identities of people making requests for their data. This matters because it shows that companies must have strong security measures to protect personal information.
What happened
BroBizz did not implement adequate security measures to protect the identities of individuals making data requests.
Who was affected
Individuals whose identities were at risk when making requests to BroBizz.
What the authority found
The authority criticized BroBizz for not following GDPR rules on data security, stating they lacked proper organizational measures.
Why this matters
This case highlights the importance of strong data security practices for companies. It serves as a reminder that failing to protect personal information can lead to serious scrutiny from regulators.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Danish company “BroBizz” that provides automatic payment on bridges and ferries reported three breaches of personal data security regarding the identification of natural persons. It follows from Article 12 (1) GDPR that, without prejudice to Article 11, if there is reasonable doubt as to the identity of the natural person making a request under Articles 15 to 21, the data controller may request additional information necessary to confirm the identity of the data subject. It further follows from Article 32 (1) GDPR that the data controller must take appropriate technical and organizational measures to ensure a level of security appropriate to the risks inherent in the data controller's processing of personal data. In the opinion of Datatilsynet, this means, among other things, that data controllers must ensure that information about data subjects does not come to the attention of unauthorized persons. Datatilsynet investigated whether BroBizz undertook appropriate measures to secure the identity of natural persons making a request according to Articles 15 to 21 and conducted a proper risk assessment. After a review of the cases, Datatilsynet found that there is reason to express serious criticism that BroBizz's processing of personal data has not taken place in accordance with the rules of Article 32 GDPR since BroBizz has failed to comply with the requirement to implement appropriate organizational security measures in securing the identity of the natural person making a request within the meaning of Articles 15-21 GDPR. Datatilsynet emphasized that the same type of incident happened three times within a short time. Therefore, the cases indicate that BroBizz's internal procedures and instructions are either insufficient or that employees are not sufficiently familiar with them. Datatilsynet also found grounds for issuing an order from BroBizz to assess the risks to data subjects associated with the type of personal data processing undertaken by the company
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2019-441-3399 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2019-441-3399 - Denmark (2020). Retrieved from cookiefines.eu
Last updated: