Blauw Research B.V. – Court Ruling (Netherlands, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Blauw Research took a software provider to court after a cyber attack exposed personal data. The court examined whether the provider met its obligations to inform the research company about the breach. This case emphasizes the need for clear communication and responsibility in data processing agreements.
What happened
Blauw Research sued its software provider after a cyber attack leaked personal data.
Who was affected
Individuals whose personal data was stored in cloud databases and surveys affected by the breach.
What the authority found
The court reviewed whether the software provider fulfilled its duty to inform the research company about the data breach as per their agreement.
Why this matters
This case underscores the importance of clear data breach communication in processing agreements. Companies should ensure their contracts specify timely and detailed reporting of security incidents.
GDPR Articles Cited
In this decision, Blauw Research B.V., a market research agency (controller) had a processing agreement with NEBU B.V., a software provider (processor). On 10-11 March 2023, the processor suffered a cyber attack by which third parties gained unauthorized access to its servers and data was extracted. The processor informed the controller about it two days after the attack took place. The controller requested more information and the processor confirmed that data (passwords) had been stolen and personal data (stored in cloud databases and surveys) were leaked. After repeatedly requesting information, unsatisfied with the processor's replies, the controller brought the case to the Court of Rotterdam. During the proceeding, the controller explained that it considered that, based on the processing agreement, the processor must provide information regarding security incidents and data breaches at all times. It also argued that the information provided following the cyber attack was not sufficient to meet the requirements set out in the agreement. The processor objected to such claim. As a result, the controller claimed to order the processor to: # provide information about (i) the details of the cyber attack; (ii) how and with what methods the system was recovered after the attack; (iii) an overview of which customers' personal data were leaked; (iv) the perpetrators of the attack; (v) which preventive and reactive technical and organisational measures were taken; (vi) internal reporting within the organization of the processor about the cyber attack that has taken place; # in the future, within 4 hours after new information is available, transfer this information to the controller and send an update on the state of affairs twice a day (at 14:00 and 19:00); # appoint a forensic investigator to find out the root-cause analysis; and # provide all necessary assistance and to answer all controller's questions. In the event of non compliance, the controller claimed a penalty
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Blauw Research B.V. in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Blauw Research B.V. - Netherlands (2023). Retrieved from cookiefines.eu
Last updated: