- The LfDI imposed a fine of EUR 1.24 million on AOK Baden-Württemberg for data protection violations in sweepstakes (2015−2019).
- More than 500 participants’ data were used for advertising purposes without their consent; insured persons’ data remained unaffected.
- The LfDI criticized inadequate technical and organizational security measures, violation of Art. 32 GDPR.
- Mitigating factors: size of the AOK, internal improvements, constructive cooperation and consideration of the coronavirus pandemic.
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI) has filed a complaint against a health insurance company (AOK Baden-Württemberg). imposed a fine of EUR 1.24 million (cf. Media release).
The LfDI identified a violation of the GDPR in the fact that AOK had collected personal data of the participants, including contact data and health insurance affiliation, in the context of sweepstakes from 2015 to 2019. This data was to be used for advertising purposes. The AOK wanted to ensure through technical and organizational measures (including internal guidelines and data protection training) that only data from participants who had consented was used. Nevertheless, personal data of more than 500 participants was used for advertising purposes without consent (but not insured persons’ data). It was thus clear to the LfDI that the AOK had taken inadequate security measures. had, which violated Art. 32 GDPR.
According to the media release, the fine was calculated on the basis of the following factors:
- the size and importance of the AOK Baden-Württemberg, in particular the fact that the Aok is a statutory health insurance company and thus “an important part of our health care system”,
- that comprehensive internal reviews and adjustments of the technical and organizational measures have been carried out,
- the “constructive cooperation” with the LfDI,
- that no insured party data was affected,
- that the buses must not jeopardize the fulfillment of AOK’s statutory mission, with special consideration given to the challenges posed by the Corona pandemic.
In other words, the fine could have been considerably higher without these circumstances. – How is reported, the AOK will not contest the buses.
It is currently open whether the amount of the fine is based on the application of the controversial sanction model of the DSK and why the LfDI located the breach at Art. 32 GDPR and not, for example, Art. 5 (principles), Art. 6 (legal basis), Art. 24 (principle of the obligation to ensure compliance with the GDPR) or Art. 25 GDPR (privacy by design).
The decision shows that the authorities know how to distinguish between paper compliance and compliance in practice, and that the grace period for fines (including the informal grace period due to the Corona pandemic) has probably expired.