Germany’s first GDPR fine offers lesson for companies planning a data breach policy

In November 2018, Germany’s first fine under the General Data Protection Regulation (GDPR) was imposed — and it was much lower than many expected. The favourable outcome of the proceedings for the defending company demonstrates that, with a proper defence strategy, GDPR infringements may not necessarily end in a worst-case scenario for companies.
In July 2018, Knuddels GmbH & Co. KG (Knuddels), operator of the chat community Knuddels.de, noted the loss of 1.8 million user data records (including a file with unencrypted user passwords) as the result of a cyberattack. After reporting this incident to the appropriate supervisory authority, Knuddels was investigated for infringement of the GDPR. Because the authority deemed that the company’s IT security was not state-of-the-art, there was a high risk that the supervisory authority would impose a large fine on Knuddels. Read more…