Hellenic DPA fines Ministry and E.E.T.A.A. over data breach
The Hellenic DPA fined the Ministry of Social Cohesion and Family Affairs EUR 200,000 and E.E.T.A.A. EUR 150,000 for a data breach caused by outdated systems and inadequate security, and ordered them to enter into a data processing agreement and implement security measures.
- Framework
- GDPR
- Who it concerns
- Ministry of Social Cohesion and Family Affairs and E.E.T.A.A. S.A.
What changed?
Each point with the sentence from the source that says it.
The Hellenic DPA found that the success of the attack was associated with E.E.T.A.A.’s continued use of outdated information systems and inadequate security measures, despite its awareness of the relevant risks.
the success of the attack was associated with E.E.T.A.A.’s continued use of outdated information systems and inadequate security measures, despite its awareness of the relevant risks
The DPA found infringements of the requirements relating to the security of processing, as well as deficiencies in compliance with the requirements of Article 28 GDPR governing the relationship between the controller and the processor.
The DPA found infringements of the requirements relating to the security of processing, as well as deficiencies in compliance with the requirements of Article 28 GDPR governing the relationship between the controller and the processor.
The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A.
The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A.
It also ordered the parties to enter into a data processing agreement pursuant to Article 28 GDPR and to fully implement the planned measures to strengthen the security of their information systems.
It also ordered the parties (i.e. the Ministry and E.E.T.A.A.) to enter into a data processing agreement pursuant to Article 28 GDPR and to fully implement the planned measures to strengthen the security of their information systems.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Records of Processing Activities
Review records of processing activities to ensure that security measures for information systems are up to date and not outdated.
- Data Protection Policy
Review data protection policy to include requirements for data processing agreements under Article 28 GDPR.