Brussels (The Brussels Morning Newspaper) – Austrian advocacy body NOYB has filed two complaints with the EU privacy watchdog against the European Parliament, blaming it for inadequately protecting employees’ personal data.
How Did the European Parliament Fail to Protect Personal Data?
Noyb has filed two objections against the European Parliament over a massive data breach that affected the personal data of over 8,000 staff members. Noyb, a non-profit organization otherwise comprehended as ‘none of your business,’ has filed complaints against the European Parliament after a recruitment portal called ‘PEOPLE’ was violated.
What Sensitive Information Was Compromised in the Data Breach?
Attackers acquired sensitive data, including ID cards, passports, criminal histories, residence documents, and even marriage certifications that included the victim’s sexual orientation. According to Noyb, to apply for a job in the EU Parliament, you must report to a recruitment platform called PEOPLE, where you must supply information about yourself. This includes “heaps of personal data,” including ID cards, passports, home and education documents, criminal records, and marriage certificates.
Was the PEOPLE Recruitment Portal the Source of the Violation?
The violation itself happened earlier this year and was found on April 25th. It’s still unknown whether it was the result of hacking or another exposure. On April 26th, 2024, the European Parliament made ex-and current employees aware that “every single document…uploaded to PEOPLE (had) been compromised.” “At the time of filing this complaint, it is still unclear how long the assailants were able to access the personal data of the applicants,” Noyb stated.
Those concerned were asked to change their IDs and passports “as a precautionary measure.”
Is the European Parliament Compliant with GDPR Standards?
Noyb argues that the Parliament has “long been aware of cybersecurity vulnerabilities.” In November 2023, a cybersecurity review indicated that the organization’s cybersecurity did not meet industry standards. Furthermore, the non-profit said that the European Parliament isn’t conceding with the GDPR’s data minimization and retention requirements.
According to Noyb, the EU GDPR needs European institutions to only process data that is “adequate, relevant and restricted to what is necessary in relation to the purposes for which they are processed.” However, the European Parliament has maintained these recruitment files for 10 years. “This is even more worrying when you believe that these files also contain specially protected sensitive info…which can reveal people’s ethnicity, political views, religious beliefs, or sexual orientation,” Noyb states.
Noyb has filed two complaints with the EU Data Protection Supervisor (EDPS) on behalf of employees within the European Parliament. The non-profit also indicates that the EDPS imposes an “appropriate organisational fine to prevent similar violations in the future.”
