This article was published in 2019. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
We start the week with the news that the German privacy regulator has imposed two fines. The fines concern two telecoms companies that acted in breach of the General Data Protection Regulation (GDPR). Below we discuss the regulator’s fines.
Mandatory DPO for telecoms providers
The German privacy regulator BFDI has imposed a fine of EUR 10,000 on the telecoms provider Rapidata. This happened because Rapidata had not appointed a Data Protection Officer (DPO). Under the GDPR, Rapidata is in fact obliged to appoint a DPO. The German regulator writes the following on this:
Ein weiteres Verfahren gegen den Telekommunikationsanbieter Rapidata GmbH wurde erforderlich, da das Unternehmen seiner gesetzlichen Auflage nach Artikel 37 DSGVO zur Benennung des betrieblichen Datenschutzbeauftragten trotz mehrmaliger Aufforderung nicht nachgekommen ist. Bei der Höhe der Geldbuße von 10.000 Euro wurde berücksichtigt, dass es sich hierbei um ein Unternehmen aus der Kategorie der Kleinstunternehmen handelt.”
Fine for ’no technical and organisational measures’
The regulator’s second fine is addressed to 1&1 Telecom GmbH. This concerns a fine of no less than EUR 9,550,000. This is because this company did not take appropriate technical and organisational measures. This is a hefty sum. On the other hand, according to the regulator, it is clear that this company did not take privacy very seriously. Employees could gain access to customer data quite easily, and the company was in no hurry to take the right measures.
What do these fines mean for your organisation?
These fines show that regulators take the privacy rules seriously: organisations must make an effort to properly safeguard the privacy of their customers or clients. Regulators are showing their teeth more and more often, which will increasingly lead to fines.
You too must comply with the privacy rules. If the regulator pays you a visit, you must be able to demonstrate that you comply with the privacy rules. If you cannot demonstrate this, the regulator can take enforcement action. This in turn can lead to high fines. You can prevent all of this.
Contact us
Are you unsure, with all these rules, whether you are complying with them properly? Then contact us for an exploratory conversation. Together with you, we will look at which rules apply to your organisation. That way you will know where you stand. This will save your organisation a great deal of stress, high fines and reputational damage.