Shanghai Moonton Technology Co. Ltd. – €72,000 Fine (Spain, 2024)

On 2 November 2022, a security breach occurred on Shanghai Moonton Technology Co. Ltd.’s (the controller) videogame forum. The controller is a Chinese videogame company headquartered in Shanghai that was acquired by Bytedance in March 2021. The breach affected 442 Spanish data subjects and included usernames on the controller’s forum, user ID numbers, frequency of each data subject’s visit to the forum, the reported sex of data subjects, IP addresses, email addresses and the data subjects’ activities on the forum including publications and interactions. On the day of the breach, 2 November 2022, the personal data obtained in the breach was published on a third party website. The following day, 3 November 2022, a member of the controller’s security team identified the publication of the data on the third party website. From 4 November to 16 November 2022, the controller investigated the data breach. The controller identified the location of each data subject based on their IP address and notified the corresponding DPAs accordingly. It began notifying DPAs on 11 November 2022. On 21 November 2022, the controller notified the Spanish DPA (AEPD) of thebreach. In its investigation, the AEPD noted that the controller used moderators which were volunteers, not employees or contractors, in order to manage its forums. Moderators were hired using a two-week trial period and were required to abide by terms of service and a code of conduct. The controller gave moderators access to users’ personal data in order to monitor the forums and where necessary, revise or eliminate posts, block user access to the forum, respond to users or approve new users. This access included data which was available to all users on the forum including data subjects’ usernames, user IDs, number of visits to the forum, reported sex, and activities on the forum. In addition, moderators were given access to personal data which was not already publicly available to all forum users: data subjects’ email addresses, time and date of the most recent activity on the forum, and IP addresses. The controller stated that it had security measures in place prior to the breach with regard to the affected data with the goal of avoiding such incidents. It was unaware of any prior security incidents and noted that it had not received any claim or request from data subjects in Spain in relation to the breach. With regard to the delay in notifying the AEPD of the breach, the controller argued that as it did not have a legal establishment in Spain, it needed to contract a legal assessor within Spain to prepare the due notification and documents. The AEPD concluded that the controller likely violated Articles 5(1)(c), 5(1)(f), 27, 32 and 33 GDPR. With regard to the data minimisation violation, the AEPD found that the controller shared more personal data of data subjects than necessary with forum moderators. It stated that it was not necessary to provide moderators access to all of this personal data – particularly email and IP addresses – in order to moderate the forums. These data were not relevant to the duties that the controller envisioned for the moderators. The AEPD also determined that the controller failed to comply with security obligations. It stated that the publication of personal data from its forum on a third party website indicated a violation of integrity and confidentiality principles under Article 5(1)(f) GDPR. The AEPD also took issue with the controller’s use of moderators – in essence, the controller permitted users who volunteered to moderate to access other users’ personal data. It employed no security measures beyond a code of conduct, terms and conditions and a two-week trial period. These measures, the AEPD found, were inadequate and violated Article 32 GDPR. The AEPD also concluded that the controller had failed to designate a representative in the European Union. The controller is a Chinese videogame company offering services in the European Union, and was thus required to do so pursuant to Article 27 GDPR. Finally, the AEPD found that the controller did not notify the AEPD of the breach within the time frame envisioned by Article 33 GDPR. The controller did not notify the DPA within 72 hours of learning of the breach, but instead took 18 days. Given these violations, the AEPD resolved to initiate sanction proceedings against the controller and recommended a sanction of €90,000. Pursuant to [https://www.boe.es/buscar/act.php?id=BOE-A-2015-10565 Law 39/2015], a Spanish law concerning administrative proceedings, the AEPD informed the controller that it may acknowledge its responsibility for the alleged violations and/or pay the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted for the latter option and reduced the fine by 20%, paying the reduced sanction amount of €72,000.