BACKGROUND:
Hackers have compromised the Chipotle food chain’s email service and then use it to send out phishing emails with malicious links. The campaign lasted for 3 days and at least 120 malicious emails were sent.
Spam is Chipotle’s secret ingredient: Marketing email hijacked to dish up malware https://t.co/RNMaSyyxMj
— IT Security News – www.itsecuritynews.info (@IT_securitynews) July 29, 2021
<p>Contrasted to the common misconception, Article 83 of GDPR is very specific about its penalties: security-related incidents are fined by up to 2% of the annual turnover, while violations such as lack of consent or unlawful data processing are punished more severely by a fine going up to 4%. Thus, Amazon’s statement that no data breach has occurred is probably not very relevant to the case. In view of the recent GDPR-related litigation in the EU and available jurisprudence, the fine, however, indeed seems to be excessive and will likely be significantly reduced on appeal. Amazon will undoubtedly endeavor to win the case in court on appeal.</p>
<p>The outcome of this case will likely be influenced by politics, as such punitive actions by the EU may strongly discourage American companies doing business in Europe. Furthermore, it may motivate US states, that are now rapidly implementing state privacy laws, to retaliate by imposing mirrored penalties upon European companies. The long-awaited federal privacy law in the US should hopefully harmonize data protection regimes and finally bring a peace of mind both to consumers and businesses on the two sides of the pond.</p>