Cybersecurity Policy Report, GDPR Offense Leads to Fine for German Debt Collector, (Nov 12, 2024)
The data protection authority (DPA) for the German city of Hamburg imposed an administrative fine of 900,000 euros ($954,000) after an unnamed debt-collection service provider violated deletion obligations under the European Union’s General Data Protection Regulation (GDPR), the DPA announced today.
The DPA alleged that the company stored records without a legal basis after deletion deadlines had long since expired. It learned of the violation while performing targeted audits of debt-collection services, it said.
The audited companies were asked to provide details about their data storage practices, including documents such as the directory of processing activities and lists of security measures. Following the written preliminary examination, the Hamburg DPA conducted site visits.
The DPA found during the on-site inspection of the noncompliant company that it continued to store data records without a legal basis, despite the passing of the applicable deletion deadlines, in violation of articles 5(1)(a) and 6(1) of the GDPR. Though the records were not passed on to third parties during this period, some of them had not been deleted from the company’s database five years after the expiration of the legal retention period, the DPA noted.
“When the customer relationship ends, the data collected must be deleted immediately or after a specified period,” said Thomas Fuchs, Hamburg’s data protection commissioner. “That is why companies should take stock of what data they collect and how long they are allowed to keep it before they collect any data. It is unacceptable for companies working in data-driven digital industries not to have developed a coherent deletion policy.”
News: InternationalLegislation GDPR LitigationEnforcement DataPrivacy