Unknown – €250,000 Fine (Malta, 2022)

€250,000

Information and Data Protection Commissioner

1 January 2022

Malta

final

Fine

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

An unknown company in Malta was fined EUR 250,000 for not having proper security measures to protect personal data. This case shows the importance of implementing strong technical and organizational safeguards to keep data safe. Companies should regularly review and update their security practices.

What happened

A company failed to implement adequate technical and organizational measures to protect personal data.

Who was affected

Individuals whose personal data was not properly protected by the company.

What the authority found

The Maltese data protection authority fined the company for not having sufficient security measures, violating GDPR's data protection requirements.

Why this matters

This significant fine emphasizes the critical need for companies to prioritize data security. It serves as a reminder to regularly assess and improve data protection measures to avoid similar penalties.

GDPR Articles Cited

Automatically processed

Art. 32(1) GDPR

View original scraped data

Art. 32(1) GDPR

(2) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Linked-source text retrieved.

Automated check recorded — 6 March 2026.

Processing notes: articles corrected.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Malta enforcement Information and Data Protection Commissioner actions All Unknown actions

Full Legal Summary

Detailed

The controller has failed to implement appropriate technical and organizational measures to protect personal data.

Show full summary

Related Enforcement Actions (8)

Other enforcement actions involving Unknown in MT

Fine

Jan 2020· Information and Data Protection Commissioner

The controller had sent unsolicited commercial messages. In addition, the privacy policy did not comply with transparency requirements and the control...

€4K

Fine

Jan 2020· Information and Data Protection Commissioner

Insufficient technical and organisational measures to ensure information security

€3K

Fine

Jan 2020· Information and Data Protection Commissioner

The controller failed to comply with a data subject's right to information. In addition, the data protection policy did not meet the transparency requ...

€20K

Fine

Jan 2020· Information and Data Protection Commissioner

The controller has unlawfully disclosed personal data of a data subject.

€5K

Fine

Jan 2022· Information and Data Protection Commissioner

The controller has violated numerous GDPR regulations, involving special categories of personal data of numerous individuals.

€65K

Fine

Jan 2022· Information and Data Protection Commissioner

The controller has unlawfully disclosed personal data of a data subject.