- Enforcing jurisdiction
- Netherlands · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
CP&A – €15,000 Fine (Netherlands, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Autoriteit Persoonsgegevens imposed a fine on CP&A for improperly recording health data related to employee absences. This is important because it underscores the need for businesses to protect sensitive health information.
What happened
CP&A was fined for unlawfully documenting health data and not securing the absence registration system.
Who was affected
Employees of CP&A whose health data was recorded without proper protection.
What the authority found
The authority ruled that CP&A violated GDPR by failing to protect sensitive health data and not implementing adequate security measures.
Why this matters
This case serves as a warning to businesses about the strict requirements for handling health data and the necessity of implementing strong security measures to protect personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Dutch DPA (AP) has imposed a fine of EUR 15,000 on CP&A. The controller had documented both the causes of illness and specific complaints of the data subjects as part of the recording of employee absences due to illness. The DPA found that this was unlawful since health data is granted special protection. Employers are not permitted to record either the reasons or causes of sick leave. Furthermore, the DPA found that the controller had not implemented adequate technical and organizational measures to protect the processing when recording absences. Namely, the absence registration was accessible online, without any form of authentication. Yet, when an absence system is accessible via the Internet, the system is to be accessed only through a multi-factor authentication. In the DPA's view, another form of authentication would have been required in addition to the 'normal' login.
Related Enforcement Actions (0)
No other enforcement actions found for CP&A in NL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
24 March 2020
Authority
Autoriteit Persoonsgegevens
Fine Amount
€15,000
About this data
Cite as: Cookie Fines. CP&A - Netherlands (2020). Retrieved from cookiefines.eu
Last updated: