University fined due to lack of appropriate TOMs

The technical aspect of data protection is often overlooked by Data Controllers who are most likely to focus on the legal aspects of the issue and fail to adopt a holistic approach to the subject of privacy.

Such was the case of the Open University of Cyprus, who got fined an amount of €45,000 fine after failing to protect personal data of active students, alumni and university contractors form a hacker attack. The hackers namely threatened to release the personal data of the aforementioned data subjects to the dark web, unless the University paid them a ransom of €100,000.

Lack of appropriate security measures was cited by the Commissioner for Personal Data Protection as the reason for the attack and the subsequent fine, while instructions for the appointment of a security systems followed. The importance of the implementation of appropriate technical and organizational measures was further underlined, since it is closely intertwined with the principle of accountability of Art. 5 (2) GDPR according to the Commissioner.

We, at DP-Dock, are ready to help our clients approach both the legal and the technical aspects of data protection and offer our assistance in a way that fits the needs of your business.

For more information please follow the link.