Violation of personal data protection by the City of Trnava as the Controller of personal data

13.02.2024

In a recent decision by the Office for Personal Data Protection, we witnessed a case of violation of the Personal Data Protection Act and GDPR. The breach of personal data protection concerned the Controller, who unlawfully disclosed personal data of 47 affected individuals, including the applicant, in a resolution of the City Council of Trnava (“Resolution”).

The legal representative of the applicant submitted a complaint against the City of Trnava as the Controller, alleging a violation of the Personal Data Protection Act and GDPR. In the complaint, it was asserted that in a Resolution informing 31 garage owners about the non-renewal of their leased land, which was owned by the City of Trnava, the Controller disclosed personal data, including name, surname, maiden name, date of birth, permanent address, contract number, date of conclusion of the contract, rental period, as well as family relationships with other owners and garage owners. Consequently, the Office for Personal Data Protection (“Office”) requested the Controller to clarify and validate the legal basis for making this data available.

The Controller provided its cooperation to the Office and acknowledged the individual wrongdoing of the employee who was assigned to carry out such a task. The Controller then responded to the incident with an apology and informed that the City of Trnava took immediate action upon discovering the violation. The Controller also claimed to have complied with the Personal Data Protection Act and GDPR when processing personal data. In addition, the Controller proved that in response to the breach of personal data protection, it conducted training for employees, recipients, and other persons handling personal data.

The Office has found, with reliable evidence, that the Controller, by sending the Resolution without adequate technical measures such as pseudonymization to protect the rights of data subjects, has made personal data of all 47 garage owners, including the applicant, available in the form of their first name, last name, maiden name, date of birth, and address of residence, without appropriate legal grounds in accordance with Article 6 (1) GDPR, thus violating the principle of legality as defined in Article 5 (1) (a) of the Regulation.

While the Controller has characterized this event as a one-off mistake caused by human error, the disclosure of personal data of the data subjects is regarded as an undue intrusion into their rights and freedoms. Such disclosure leads to a loss of control over the processing of personal data, which is an irreversible and incompatible situation with the requirements.

The right of affected subjects to have control over the processing of their personal data is one of the principal rights that the Controller must uphold throughout the entire processing period. It is the sole responsibility of the Controller to ensure the security and safety of personal information being processed.

To comply with all GDPR requirements and to ensure strict enforcement of its provisions, the Controller has an obligation. During the investigative process, the Office has determined that the Controller failed to observe these responsibilities.

Ultimately, the Office has decided to impose a penalty of 2.200,- EUR on the Controller for violating the Data Protection Act and the GDPR, as its actions contravened the principle of legality relating to the protection of personal data. However, the Controller willingly instituted measures to prevent the recurrence of such breaches, and the worker who had erroneously disclosed personal data was retrained on the rights and duties of processing personal data. Consequently, the Office found it unnecessary to enforce any other corrective measures.

When deciding on the imposition and amount of the fine, the Office considered several factors. The nature and severity of the breach was evaluated as an aggravating circumstance, as a violation of the basic principle of personal data processing was discovered. Such a breach could result in a fine of up to 20.000.000,- EUR, as well as the number of data subjects affected. Mitigating factors included the unintentional nature of the breach, the category of personal data involved (ordinary data), and the fact that the Controller did not obtain any financial or non-financial gain from the GDPR breach. Additionally, the fact that the Controller reported the breach to the Office as a violation of personal data protection was also taken into account as a mitigating circumstance.

Article provided by INPLP member: Miroslav Chlipala (BCH, Slovakia)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)

What is the INPLP?

INPLP is a not-for-profit international network of qualified professionals providing expert counsel on legal and compliance issues relating to data privacy and associated matters. INPLP provides targeted and concise guidance, multi-jurisdictional views and practical information to address the ever-increasing and intensifying field of data protection challenges. INPLP fulfils its mission by sharing know-how, conducting joint research into data processing practices and engaging proactively in international cooperation in both the private and public sectors.