NJORD Law Firm’s data protection and litigation team is pleased to share news of the successful resolution of the dispute concerning the Asper Biogene data leak case.
At the beginning of 2024, a case received widespread media attention in which cybercriminals broke into the information system of Asper Biogene, a company specialising in genetic testing, and downloaded documents containing patients’ health data. After the attack was discovered, the Data Protection Inspectorate (DPI) was notified in September 2023, which led to the initiation of supervision proceedings and later misdemeanour proceedings. The Data Protection Inspectorate imposed a fine of 85,000 euros on Asper Biogene, accusing the company of two violations. Firstly, the company had appointed a member of its management board as the data protection officer, thereby violating the obligation to avoid conflicts of interest and to appoint a competent data protection officer. Secondly, the Data Protection Inspectorate found that the company had not implemented adequate security measures.
With a recent decision of the Supreme Court, by which the Data Protection Inspectorate’s appeal in cassation was not accepted for proceedings, the year-and-a-half-long dispute between Asper Biogene and the Data Protection Inspectorate has come to an end. As a result, the county court’s decision entered into force, by which the court
- annulled the fine imposed by the Data Protection Inspectorate on Asper Biogene in the amount of 85,000 euros in full.
- terminated misdemeanour proceedings regarding the appointing of the data protection officer due to minor fault and lack of public interest in the proceedings, noting that in data protection matters, greater cooperation and prevention are preferred, and punishment is not always expected in every case.
- terminated the misdemeanour proceedings regarding the alleged shortcomings in security measures due to the absence of elements of a misdemeanour.
Asper Biogene was successfully represented in the litigation by Triinu Hiob, Partner and Head of Disputes at NJORD Law Office, and Henri Oliver Palm, Assistant Attorney-at-Law in NJORD’s data protection team.
