the cases
Real decisions from authorities and courts, told through the belief each one disproved.
- “we report it once we know what happened”Booking.com was fined €475,000 for reporting a breach 22 days late. The fine was for the delay.
- “the supplier ran it, so the breach is theirs”The misconfigured server was the processor's. The customer received most of the fine, about PLN 16.9 million against about PLN 184,000.
- “if we get hacked, we automatically lose”The Court of Justice ruled that a breach alone does not prove your security was inadequate. It also ruled that you carry the burden of proving it was adequate.
- “we fixed the breach, so we are done”Of the €251 million, €11 million was for an incomplete notification and poor breach records. The rest was for how the system was designed.
your next step
Not sure which of these touch you? Six questions will narrow it down.