noyb lodges complaints against EU Parliament over data breach
The European Parliament has come under scrutiny following a significant data breach affecting its recruitment platform, PEOPLE. This breach compromised the personal data of over 8,000 current and former employees, including sensitive information such as ID cards, passports, and marriage certificates. The incident has raised serious concerns regarding the security measures in place to protect applicants’ data, especially given the sensitive nature of the information provided.
On April 26, 2024, the European Parliament informed the European Data Protection Supervisor (EDPS) about the breach, which left many individuals unsure of how their data was accessed. By May 31, the Parliament advised those affected to replace their identification documents and offered to reimburse them for the associated costs. Despite these steps, the timeline of the breach and how long the attackers had access to the data remain unclear. Experts have pointed out that the Parliament has a responsibility to implement robust security measures, especially in light of previous cybersecurity incidents.
The breach highlights ongoing vulnerabilities within the Parliament’s IT infrastructure. A cybersecurity review conducted in November 2023 revealed that the institution’s security measures did not meet industry standards and were inadequate against threats from state-sponsored hackers. This breach occurred amidst a series of attacks on EU institutions, including incidents involving Russian hacking groups and the discovery of spyware on the devices of Members of the European Parliament (MEPs).
Furthermore, the breach raises questions about the Parliament’s compliance with the General Data Protection Regulation (GDPR) regarding data minimization and retention. The EU Parliament retains recruitment files for ten years, which is concerning given that these files often contain sensitive personal data. In response to the breach, noyb has filed two complaints with the EDPS, arguing that the Parliament violated several GDPR articles. The organization has requested corrective actions and potential fines to ensure better compliance in the future.
Source: noyb complaints against EU Parliament over data breach
