Editing LfDI - Fine EUR 100,000 against food craft company

{{DPAdecisionBOX

|Jurisdiction=Germany
|DPA-BG-Color=background-color:#3d4f63;
|DPAlogo=LogoDE-BW.png
|DPA_Abbrevation=LfDI (Baden-Württemberg)
|DPA_With_Country=LfDI (Baden-Württemberg)

|Case_Number_Name=
|ECLI=

|Original_Source_Name_1=LfDI (Baden-Württemberg)
|Original_Source_Link_1=https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2020/01/35.-T%C3%A4tigkeitsbericht-f%C3%BCr-den-Datenschutz-Web.pdf#page=44&zoom=100,0,0
|Original_Source_Language_1=German
|Original_Source_Language__Code_1=DE
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Type=Investigation
|Outcome=Violation Found
|Date_Started=
|Date_Decided=24.10.2019
|Date_Published=30.01.2020
|Year=2019
|Fine=100,000
|Currency=EUR

|GDPR_Article_1=Article 5(1)(f) GDPR
|GDPR_Article_Link_1=Article 5 GDPR#1f
|GDPR_Article_2=Article 32 GDPR
|GDPR_Article_Link_2=Article 32 GDPR
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_4=
|GDPR_Article_Link_4=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=Food craft company (unknown)
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=
|
}}

The LfDI (Baden-Württemberg) imposed a fine of EUR 100,000 on an medium-sized food craft company. The data controller unlawfully processed personal data and violated [[Article 5 GDPR#1f|Article 5(1)(f) GDPR]]. It also did not process personal data with an appropriate level of security, as required by [[Article 32 GDPR]].

==English Summary==

===Facts===
The company accepted applications via an applicant portal integrated into its website. However, the data transmission was not encrypted. The storage of applicant data was also not encrypted and was not password protected. In addition, there was a link to Google for the unsecured applicant data, which meant that the application documents could be called up by anyone within the scope of a search of the applicant's name via Google. 

===Holding===
The German supervisory authority LfDI Baden-Württemberg fined EUR 100,000 the food craft company, because it had unlawfully processed personal data violating [[Article 5 GDPR#1f|Article 5(1)(f) GDPR]] and it had not established an appropriate level of security, as required by [[Article 32 GDPR]].

==Comment==
''Share your comments here!''

==Further Resources==
''Share blogs or news articles here!''

==English Machine Translation of the Press release==
There is no machine translation of the original decision. Please refer to the German original for details.
<pre>

</pre>