It is the highest fine ever imposed in Baden-Württemberg: The unauthorized use of personal data from a competition for advertising purposes is expensive for the AOK.
The State Data Protection Officer imposed a fine of 1.2 million euros on the AOK Baden-Württemberg for violating the European General Data Protection Regulation (GDPR).
The health insurance company organized contests between 2015 and 2019 and collected personal data of the participants, including their contact details and affiliation with the health insurance fund, the State Commissioner for Data Protection said on Tuesday in Stuttgart.
Previously, the AOK had actually promised to only use the data of the competition participants for advertising purposes if the participants had given their consent. However, this was ignored.
Biggest punishment so far
The million fine is the highest penalty ever imposed in the Southwest for an error in data protection. The penalty was pronounced because the health insurance company misused data from the competitions, the State Data Protection Commissioner said. So far, the Internet provider 1 & 1 Telecommunications had to pay the highest sum nationwide due to violations of the GDPR with a fine of 9.55 million euros.
In the current case in Baden-Württemberg, the country’s top data protection officer, Stefan Brink, complained that the measures specified by the AOK did not meet the legal requirements. For example, personal data from more than 500 participants were used for advertising without this being allowed. Insurance data were not affected. The AOK quickly set the course for better data protection.
– .
