- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2020-441-4364 – Violation Found (Denmark, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Danish data protection authority found that the Copenhagen Zoo failed to secure personal data after a breach exposed login information of about 140,000 annual cardholders. This is important because it shows that companies must implement strong security measures to protect user data.
What happened
The Copenhagen Zoo reported a data breach where a software engineer accessed annual cardholders' login information.
Who was affected
Approximately 140,000 annual cardholders of the Copenhagen Zoo were affected.
What the authority found
The authority determined that the Zoo did not have adequate security measures in place, violating GDPR's requirements for data protection.
Why this matters
This ruling serves as a reminder that organizations must prioritize data security and communicate effectively with users about breaches. Companies should regularly assess their security practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 3 January 2020 the Copenhagen Zoo reported a breach of personal data security to the Danish DPA. A software engineer informed the Zoo that via a self-developed script he acquired access to annual cardholders' log-in information (username and associated password). In turn, it was possible to gain unauthorized access to card numbers, names, addresses and e-mails of approx. 140,000 annual cardholders registered. The Zoo was unable to say how many of data subjects were affected and for how long. It stated that the engineer gained access to the data but did not use it. Following the analysis of web page views, the Zoo concluded that it was unlikely that annual cardholders data were exposed to unauthorized parties. The Zoo partially notified the data breach to data subjects on 3 January 2020 via e-mail and website. However, it did not inform data subjects about the likely consequences of the breach or an approximate indication of the period during which the breach lasted. Subsequently, the Danish DPA found out that the communication had not reached all of the annual cardholders registered. After the breach of personal data security, the Zoo introduced a new log-in feature: (1) "i'm not a robot" feature and (2) a feature that blocks log-in for one hour after three erroneous log-in attempts. All annual card holders were forced to change their password. Did the Copenhagen Zoo establish an appropriate level of security for the login page for annual cardholders? Did the Zoo properly assess the risks that the breach posed to the data subjects' rights? How should communication of a personal data breach be delivered to the data subject? How the controller should communicate the risks posed to the data subjects' rights? The Danish DPA found that Zoo has not complied with Article 32 (1) of the GDPR by failing to implement an appropriate level of security of the login page for annual cardholders. The DPA advised to introduce a procedure that ensures regular assessment of the
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020-441-4364 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020-441-4364 - Denmark (2020). Retrieved from cookiefines.eu
Last updated: