631.30 and 535.461
Berlin Commissioner for Data Protection and Freedom of Information
Final decision concerning the data breach reported by AWIN AG
Ladies and gentleman,
As you know, our authority, as lead supervisory authority, has informed the concerned supervisory
authorities in Europe about the above mentioned notification and the measures (Art. 60 GDPR)
because of the cross-border nature of the processing.
The case has been closed.
Justification:
According to our recommendations, the controller has taken precautionary measures and on 8
February 2019 placed a notification pursuant to Art. 34 (3) (c) GDPR on their German and British
websites. The notifications remained online at least until the end of March 2019 and are available at
https://www.awin.com/de/dsgvo/mitteilung and
https://www.awin.com/gb/gdpr/notifications .
Of the 47 stolen laptops, only nine had unencrypted hard disks (see e-mail from the controller of 5
November 2018). In due consideration of Art. 34 (3) (a) GDPR, we concentrated on these nine
laptops in the further processing.
In order to find out whether and if so which personal data of business clients were stored on the
laptops and if there is an obligation to notify the data subject according to Art. 34 GDPR the
controller determined to which (former) employees the laptops were assigned to. From the
computer codes starting with MUC, PAR and LON it, 7 laptops could be assigned to the Munich
branch, one to the Paris and one to the London branch. Accordingly it was assumed that there are
concerned data subjects in France, the UK and Germany.
As both working students and junior employees do not process any personal data on their laptops,
and out of the seven German laptops four were assigned to working students and a junior employee,
our focus remained on three laptops in Germany and one in the UK.
Against this background the notification was put online by the controller in German and in English.
With regard to France the controller confirmed with e-mail dated 13 February 2019 that also the
French laptop was assigned to a junior employee and did therefore not process any personal data.
Therefore the planned notification in French remained unpublished.