EU Parliament Faces Scrutiny Over Massive Data Breach

The European Parliament is facing scrutiny after a significant data breach exposed the personal information of over 8,000 of its staff members. The breach, which affected the institution’s recruitment platform, compromised sensitive data such as ID cards, passports, marriage certificates, and criminal records.

Today, the privacy organization noyb filed two complaints on behalf of four employees, citing concerns over the Parliament’s failure to protect sensitive data and comply with the General Data Protection Regulation (GDPR).

The complaints allege that the Parliament violated GDPR’s data minimization and retention rules by storing recruitment files for 10 years, far longer than necessary.

Noyb states that in early May, the European Parliament informed its staff about a massive data breach in its recruitment platform. The Parliament only discovered the breach months after it occurred and has yet to determine the exact cause.

The data breach has raised serious concerns about the European Parliament’s cybersecurity practices, particularly given that the institution was already aware of vulnerabilities.

A cybersecurity review conducted in November 2023 revealed that the Parliament’s security measures were not up to industry standards and were inadequate against the threat posed by state-sponsored hackers.

This breach follows a series of cybersecurity incidents involving EU institutions. These include attacks by Russian hacking groups and the discovery of spyware on devices belonging to members of the Parliament’s security and defense subcommittee.

The implications of the breach extend beyond the immediate harm to those affected. As Max Schrems, Chairman of noyb, pointed out, “It is worrying that EU institutions are still so vulnerable to attacks. Having such information floating around is not only frightening for the individuals affected, but it can also be used to influence democratic decisions.”