The data controller, a telecommunication company, failed to employ proper organizational and security measures. This resulted in the exposure of various personal data to a customer who simply entered another customer’s name and date of birth. According to Art. 32 GDPR, the company employed an inadequate BfDI, which wasn’t enough to properly secure and protect the processing of personal data. However, the company was very cooperative with the data protection authority, so the fine was reduced from EUR 9,55 million to EUR 900,000. The culpability of the company was reasonably low to justify this decrease in the fine’s value, due to the fact that the company’s procedure of identifying customers through the hotline by asking only the name and date of birth wasn’t objected by any customer, so the company wasn’t aware of the problem this procedure posed. Moreover, the court of law deemed that this problem didn’t result in a massive data leakage.
the data controller a telecommunication company failed to employ proper organizational and security measures this resulted in the exposure of various personal data to a customer who simply entered another customer’s name and date of birth according to   the company employed an inadequate bfdi which wasn’t enough to properly secure and protect the processing of personal data however the company was very cooperative with the data protection authority so the  was reduced from  million to  the culpability of the company was reasonably low to justify this decrease in the ’s value due to the fact that the company’s procedure of identifying customers through the hotline by asking only the name and date of birth wasn’t objected by any customer so the company wasn’t aware of the problem this procedure posed moreover the court of law deemed that this problem didn’t result in a massive data leakage
 data controller  telecommunication company fail  employ proper organizational  security measure  result   exposure  various personal data   customer  simply enter another customer’ name  date  birth accord     company employ  inadequate bfdi  ’ enough  properly secure  protect  process  personal data however  company   cooperative   data protection authority     reduce   million    culpability   company  reasonably low  justify  decrease   ’ value due   fact   company’ procedure  identify customers   hotline  ask   name  date  birth ’ object   customer   company ’ aware   problem  procedure pose moreover  court  law deem   problem ’ result   massive data leakage