Summary Final Decision Art 60
Complaint
Dismissal of the case
Background information
Date of final decision: 5 February 2020
LSA: DK
CSAs: DE-Schleswig-Holstein, FR, SE
Controller: Garnio ApS/Hobbii Aps (Garnio ApS changed its name on 8 April 2019).
Legal Reference: Right of access by the data subject (Article 15), Security of processing (Article 32), Personal data breach (Articles 33 and 34), and Tasks of the Data Protection Officer (Article 39).
Decision: Dismissal of the case
Key words: Data breach, security
Summary of the Decision
Origin of the case
The complainant requested access to his data processed by the controller. As a result of this request, the controller provided the personal data of another individual. The complainant contacted the controller again about the breach but the controller did not reply to the inquiry.
Findings
The LSA found that the data subject in this case was not entitled to complain, as the processing of personal data did not relate to that individual.
Decision
The LSA took notice of the security issue and the occurred breach of personal data. This will be taken into consideration during the planning of audits.
—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_dk_2020-02_security_of_processing_article_32_summarypublic.pdf
Please see also EDPB Copyright page