CNIL (France) - SAN-2022-009: Difference between revisions

Revision as of 16:34, 25 April 2022

CNIL (France) - SAN-2022-009

Authority:	CNIL (France)
Jurisdiction:	France
Relevant Law:	Article 28 GDPR Article 29 GDPR Article 32 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:	23.02.2021
Decided:	15.04.2022
Published:	21.04.2022
Fine:	1500000 EUR
Parties:	n/a
National Case Number/Name:	SAN-2022-009
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Légifrance (in FR)
Initial Contributor:	czapla

The French DPA imposed a fine of €1,500,000 for violations of Articles 28, 29, and 32 GDPR on Dedalus Biologie, a software solutions provider acting as a processor for medical analysis laboratories after a data breach.

English Summary

Facts

In February 2021, a press article was published that revealed that confidential information of 500,000 French patients had been stolen from laboratories and disseminated online. The French DPA subsequently carried out an investigation, finding that the personal data of 491,840 patients had been published, including sensitive data such as health data.

Dedalus Biologie is a software solutions provider for those medical analysis laboratories involved in the data breach.

Holding

The DPA imposed a fine of €1,500,000.

First, the DPA found that Dedalus Biologie was the processor pursuant to Article 4(8) GDPR to the extent that it provides laboratories with the tools to facilitate the implementation of processing and only acts in the name and under the responsibility of the laboratories.

Consequently, the DPA held that the processor had violated Article 28(3) GDPR because the contracts between it and the controllers did not provide the necessary information.

Then, the DPA found a breach of Article 29 GDPR. The processor had processed data beyond the instructions given by the data controllers by extracting more data than necessary for the commissioned data migration from software to another tool.

Finally, the DPA held that the processor had violated Article 32 GDPR due to many technical and organisational shortcomings in terms of security of operations to migrate the software to another, including:

• lack of specific procedure for data migration operations;

• lack of encryption of personal data stored on the problematic server;

• absence of automatic deletion of data after migration to the other software;

• absence of authentication required from the internet to access the public area of the server;

• use of user accounts shared between several employees on the private zone of the server;

• lack of supervision procedure and security alert escalation on the server.

Based on the seriousness of the breaches identified and also taking into account the turnover of the company, the DPA decided on the high fine. At the same time, it seized the Paris court which blocked access to the site on which the leaked data was published. The court’s decision made possible to limit the consequences of the breach on affected individuals.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

@@ Line 53: / Line 53: @@
 }}
-The French data protection authority ('CNIL') imposed a fine of €1.5 million for violations of Articles 28, 29, and 32 of the GDPR on Dedalus Biologie, a software solutions provider for medical analysis laboratories. The fine was decided after the CNIL’s investigation into a data breach affecting two laboratories that were serviced by Dedalus Biologie. The breach was first revealed in the press on the 23 February 2021 and it affected personal data of nearly 500,000 individuals. The personal data included health data such as illnesses, genetic diseases, pregnancies, drug treatments, genetic data.
+The French DPA imposed a fine of €1,500,000 for violations of [[Article 28 GDPR|Articles 28]], [[Article 29 GDPR|29]], and [[Article 32 GDPR|32 GDPR]] on Dedalus Biologie, a software solutions provider acting as a processor for medical analysis laboratories after a data breach.
 == English Summary ==
 === Facts ===
-The CNIL identified the following violations of the GDPR:
+In February 2021, a press article was published that revealed that confidential information of 500,000 French patients had been stolen from laboratories and disseminated online. The French DPA subsequently carried out an investigation, finding that the personal data of 491,840 patients had been published, including sensitive data such as health data.
-# A breach of the article 29 of the GDPR - Dedalus Biology processed data beyond the instructions given by the data controllers by extracting more data than it was necessary for the commissioned data migration from software to another tool.
+Dedalus Biologie is a software solutions provider for those medical analysis laboratories involved in the data breach.
-# A breach of the article 32 of the GDPR - Many technical and organizational shortcomings in terms of security of operations to migrate the software to another, including:
+=== Holding ===
+The DPA imposed a fine of €1,500,000.
+First, the DPA found that Dedalus Biologie was the processor pursuant to [[Article 4 GDPR|Article 4(8) GDPR]] to the extent that it provides laboratories with the tools to facilitate the implementation of processing and only acts in the name and under the responsibility of the laboratories.
+Consequently, the DPA held that the processor had violated [[Article 28 GDPR|Article 28(3) GDPR]] because the contracts between it and the controllers did not provide the necessary information.
+Then, the DPA found a breach of [[Article 29 GDPR]]. The processor had processed data beyond the instructions given by the data controllers by extracting more data than necessary for the commissioned data migration from software to another tool.
+Finally, the DPA held that the processor had violated [[Article 32 GDPR]] due to many technical and organisational shortcomings in terms of security of operations to migrate the software to another, including:
 • lack of specific procedure for data migration operations;
@@ Line 75: / Line 85: @@
 • lack of supervision procedure and security alert escalation on the server.
-. A breach of the article 28 of the GDPR - the general conditions of sale offered by Dedalus Biologie and the maintenance contracts did not contain the information provided for in article 28 (3) of the GDPR.
+Based on the seriousness of the breaches identified and also taking into account the turnover of the company, the DPA decided on the high fine. At the same time, it seized the Paris court which blocked access to the site on which the leaked data was published. The court’s decision made possible to limit the consequences of the breach on affected individuals.
-=== Holding ===
-Based on the above findings, the CNIL imposed a fine of 1.5 million euros and decided to make its decision public. The amount of this fine was decided in view of the seriousness of the breaches identified but also taking into account the turnover of the company. At the same time, the CNIL seized the Paris court which blocked access to the site on which the leaked data was published. The court’s decision made possible to limit the consequences  of the breach on affected individuals.
 == Comment ==