Restaurant
ไม่มีให้บริการ
Insufficient technical and organisational measures to ensure information security
วันที่ตัดสินใจ
1 มกราคม 2564
อำนาจ
Data Protection Authority of Saarland
DE
ภาคส่วน
Accomodation and Hospitality
ประเทศ
DE
กฎหมาย
GDPRสถานะ
FINALคำอธิบาย
A restaurant had disposed of 120 completed guest registration forms for contact tracing purposes during the Covid-19 pandemic in a publicly-accessible dumpster. During its investigation, the DPA also found that already during the restaurant's operation, the restaurant had not implemented adequate safeguards to protect the data processed during the guest registration process. For example, the completed guest registration forms were kept in an adjoining room accessible to all employees without special security measures, such as a locked cabinet.
การอ้างอิงทางกฎหมาย
Art. 24Art. 32
ปัญหาและการละเมิด
Insufficient technical and organisational measures to ensure information security