Not named in the source

What happened

A company accidentally cc’d a third party in an e-mail to a data subject concerning a debt collection case and failed to respond to their access request. The DPA warned a company in a prima facie decision that it likely violated Article 12(3) GDPR and Article 32 GDPR.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(f) · 5(2)Read →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subject12(3)Read →
• Art. 24Responsibility of the controllerRead →
• Art. 32Security of processingRead →

• Accountability
• Data principles
• Data security
• Transparency