HmbBfDI (Hamburg) - Geldbuße gegen Kindertagesstätte
| HmbBfDI - Geldbuße gegen Kindertagesstätte | |
|---|---|
 | |
| Authority: | HmbBfDI (Hamburg) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 32(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Geldbuße gegen Kindertagesstätte |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | German |
| Original Source: | Hamburg Data Protection Authority (in DE) |
| Initial Contributor: | CBMPN |
A Hamburg daycare center (kindergarten) was fined for improperly disposing of sensitive documents containing children’s personal data in a publicly accessible recycling bin. The files included health records, bank account information and ID copies.
English Summary
Facts
A Hamburg resident discovered multiple unsealed file folders from a nearby kindergarten in a publicly accessible paper recycling container. These folders contained sensitive documents, including childcare contracts with parents' banking details, daycare vouchers issued by district offices, children's vaccination records, pickup authorizations, copies of ID documents of adults, detailed child information sheets, and results of child health screenings. The finder contacted the daycare center, but they refused to take appropriate remedial action, only offering for the finder to return the files personally. The kindergarten declined to collect or properly dispose of the documents, prompting the finder to escalate the matter to the Hamburg Data Protection Authority (HmbBfDI). After reviewing the facts, the HmbBfDI imposed a low four-figure fine on the daycare center for improper document disposal.
Holding
The improper disposal of these documents violated Article 32(1) GDPR, as highly sensitive personal data, including those of children, were exposed to public access. The files contained intimate developmental records, health information, contact details, and financial data, posing a high risk of misuse. One document on a preventive medical examination described the development of a boy's testicles, while another document explained that a child was now able to use the toilet independently but still needed to learn to use the zipper better. Additionally, identity document copies and financial data were found among the files, increasing the potential for fraud. Given the sensitivity of the data and the vulnerability of the affected individuals (children), the HmbBfDI deemed it necessary to impose a fine. The authority considered mitigating factors, including the kindergarten's lack of prior violations and the fact that the breach resulted from negligence rather than intent. The fine was accepted, and the decision is legally binding.
Comment
The amount of the fine was not revealed to the public. It was only stated that it was well below €10,000.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
In the spring of the previous reporting period, a man from Hamburg made a discovery in a waste paper depot container in the city of Hamburg: Several files from a nearby daycare center were publicly accessible and intact. The files contained a large number of documents, such as care contracts with the account details of legal guardians, daycare vouchers issued by district offices, children's vaccination records, pick-up permits, copies of adult ID documents, detailed information sheets for children in care, results of child health checks and much more. The person who found the bundle then informed the daycare center, which was not willing to provide adequate redress for the obvious problem. The caller was only offered the option of bringing the files to the daycare center himself. The daycare center, on the other hand, refused to pick them up or offer to have the documents properly destroyed by the finder. The finder then rightly contacted the HmbBfDI. After examining the factual and legal situation and hearing from the daycare center, the HmbBfDI imposed a fine in the low four-digit range. The improper disposal of documents violates Art. 32 Para. 1 GDPR. In addition, in the present case, personal data of children, i.e. of persons requiring special protection, was visible to everyone. The files also contained detailed development documentation, contact information, in some cases health data and also information about parents and those authorized to pick up the child. One document on a preventive medical examination described the development of a boy's testicles, while another document explained that a child was now able to use the toilet independently but still needed to learn to use the zipper better. These examples illustrate that the personal data processed in a daycare center naturally provide the most intimate insights into child development. In addition, contact details and account details were processed in connection with care contracts. Many documents also contained the parents' signatures. In two cases, copies of identity documents were disposed of. Such data has a high potential for misuse. Due to the quality of the personal data and the fact that many of those affected were children, the HmbBfDI considered it necessary to impose a fine. When determining the fine, the fact that this was a first violation and only negligent commission could be proven was taken into account in the daycare center's favor. The fine was accepted and the decision is legally binding.
