Details:

Summary The DPA’s decision shows that it took almost five months for the company to notify the data subjects of a data breach and almost three months for the DPA to receive a notification of a data breach concerning an security lack of IT systems of the company.
Link: link
Related articles:  Art. 33 GDPR, Art. 34 GDPR
Type: Insufficient fulfilment of data breach notification obligations
Fine: EUR 18,700
Sector Public Sector and Education

 

All data is based on The CMS’s Law GDPR Enforcement Tracker Source: https://www.enforcementtracker.com/

Tags: case law