T. Hansen Gruppen A/S – Order (Denmark, 2021)

The data subject, who is the customer of T. Hansen Gruppen A/S (the controller) filed a complaint against the company. The data subject's personal information had been accessed by an unauthorised person because the controller had failed to implement appropriate security measures. The data subject stated that they had a customer profile on the controller's website, where their mobile number was used as a customer number. In 2020 they discovered that another person's data appeared in their profile, namely, this other person's email address, their purchase history, but also data subject's previous phone number. The data subject argued that the issue occurred because this other person had received their previous mobile number, and when this person made a purchase on the controller's website, both customers' data were put into the same profile. Thus, the unauthorised person had gotten access to the data subject's personal information. The controller confirmed that the unauthorised person's information was available in data subject's profile for an unknown period. It explained that if the unauthorised person would have decided to use "resend password" function, the password would have been sent in clear text to their email. However, the controller also stated that the unauthorised person had neither accessed the website login, nor used the function "resend password". Furthermore, the controller argued that the incident was unlikely to result in a risk to the data subject's rights or freedoms, as no personal information had been compromised, and therefore, decided not to notify the data breach to the DPA. The Danish DPA held that T. Hansen Gruppen A/ had not implemented appropriate security measures pursuant to Article 32(1) GDPR to prevent unauthorised access to its customers personal data, and ordered the company to use a recognised algorithm (e.g. hashing) to encrypt all passwords so that they are not stored or can be reset in clear text. Furthermore, the DPA foun