PrivatBo – €20,100 Fine (Denmark, 2020)

In 2018, the management company PrivatBo assisted a housing fund with the sale of three properties. PrivatBo had provided the documents necessary for the sale of the properties to the occupants of the properties via USB keys. However, the documents handed to the occupants contained personal data of a confidential nature, such as the leases of tenants, which should not have been handed out. The matter was brought before the Danish DPA. Was PrivatBo in breach of its obligations under GDPR Article 32? Datatilsynet held that PrivatBo had not complied with the requirements of Article 32 of the GDPR to implement appropriate technical and organizational security measures. Datatilsynet also chose to report PrivatBo to the police for the unintentional disclosure of personal information that took place as part of the handing over of the 424 USB keys. Datatilsynet also expressed further criticism against PrivatBo for sharing information about outstanding deposits and prepaid rent with residents in a property other than that which was subject to the tender obligation in question.