European GDPR Law and Heavy Data Leak Fines

Thansettakij•Economy•7d ago

Reader Briefing

The European Union enforces the General Data Protection Regulation (GDPR) with high administrative fines for organizations failing to protect personal data.

•GDPR has been in effect since May 25, 2018 (2018) across EU member states and the UK via UK GDPR.
•The Dutch Data Protection Authority fined Ridetech International B.V. 100 million euros for improper data transfers to Russia.
•The Spanish Data Protection Authority fined ALIA GESTION INTEGRAL DE SERVICIOS, S.L. 150,000 euros following a ransomware attack.
•GDPR allows affected individuals to claim damages for property or mental harm under Article 82.

Overview

•The European Union (EU) implements the General Data Protection Regulation (GDPR) to set a uniform standard for personal data protection.
•GDPR became effective on May 25, 2018 (2018), covering EU member states and the United Kingdom via UK GDPR.
•The Dutch Data Protection Authority (Dutch DPA) ordered Ridetech International B.V. to pay a 100 million euro fine for transferring user data to the Russian Federation without adequate safeguards.
•Ridetech International B.V. incorrectly identified itself as a Processor instead of a Controller, leading to insufficient legal guarantees for data transfers to Russia.
•The Spanish Data Protection Authority (AEPD) fined ALIA GESTION INTEGRAL DE SERVICIOS, S.L. 150,000 euros after a ransomware attack affected 77,027 individuals.
•The Spanish Data Protection Authority (AEPD) found that ALIA GESTION INTEGRAL DE SERVICIOS, S.L. had insufficient security measures, allowing attackers to use stolen VPN accounts and digital certificates.
•The Spanish Data Protection Authority (AEPD) initially set a 250,000 euro fine for ALIA GESTION INTEGRAL DE SERVICIOS, S.L., but reduced it to 150,000 euros because the company accepted liability and paid immediately.
•Organizations under GDPR may face administrative penalties under Article 83 even if they are victims of ransomware, provided security measures were inadequate.

Full article content is available on the original source.

Read on Thansettakij (Thai Version)View in Google Translate

Source: Thansettakij (Original)

Key Entities

Organization

European Union(สหภาพยุโรป)ℹ️

A region that implements the General Data Protection Regulation (GDPR) for strict personal data protection.

Dutch Data Protection Authority(หน่วยงานคุ้มครองข้อมูลส่วนบุคคลของเนเธอร์แลนด์)ℹ️

The regulatory body in the Netherlands that fined Ridetech International B.V.

Ridetech International B.V.

The provider of the Yangoo ride-hailing application that was fined 100 million euros.

Yangoo

A ride-hailing application provided by Ridetech International B.V.

Spanish Data Protection Authority(สำนักงานคุ้มครองข้อมูลส่วนบุคคลของสเปน)

The regulatory body in Spain, also known as AEPD, that fined ALIA GESTION INTEGRAL DE SERVICIOS, S.L.

AEPDℹ️

The abbreviation for the Spanish Data Protection Authority.

ALIA GESTION INTEGRAL DE SERVICIOS, S.L.(ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L.)

A company fined 150,000 euros by the AEPD after a ransomware attack.

Law

General Data Protection Regulationℹ️

A regulation (EU) 2016/679 that sets standards for personal data protection and defines duties for data controllers.

UK GDPRℹ️

The application of GDPR principles within the United Kingdom.

Place

United Kingdom(สหราชอาณาจักร)ℹ️

A country that applies GDPR principles through UK GDPR.

Russian Federation(สหพันธรัฐรัสเซีย)ℹ️

A country where Ridetech International B.V. transferred personal data without adequate protection measures.