AgID Fined €55,000 for Silent Migration of Personal Email Data Without Consent
AgID violated fundamental GDPR principles by automatically migrating certified email addresses from INI-PEC to the INAD index without informing data subjects beforehand, breaching the purpose limitation and transparency requirements under Articles 5, 12, 14, and 25. This meant individuals had no opportunity to opt out before their personal contact data became accessible in a new, broader context — including to colleagues. The two-year delay in launching an information campaign compounded the harm, demonstrating that retroactive communication cannot substitute for lawful, timely notice. This case underscores that data repurposing — even within government systems — requires a fresh legal basis and proactive transparency, not assumptions of implied consent. Organizations must treat data migrations as new processing activities subject to full GDPR scrutiny.
Tactical Insight
Immediate actions
- Conduct a data protection impact assessment (DPIA) before any migration or repurposing of personal data to a new system or index.
- Notify all affected data subjects in advance of any transfer, clearly explaining the new purpose, legal basis, and their opt-out rights.
Governance & Design improvements
- Embed Privacy by Design (GDPR Article 25) into system migration projects by requiring DPO sign-off before go-live.
- Establish a data inventory and purpose registry to flag when existing data is being used beyond its originally stated purpose.
- Define a maximum acceptable delay for data subject notification (e.g., 30 days) as a binding internal policy standard.
Access Control & Accountability measures
- Restrict access to migrated personal data until data subjects have been notified and the opt-out window has elapsed.
- Implement role-based access controls to prevent unintended exposure of personal contact data (e.g., emails visible to co-workers).
- Assign clear data stewardship ownership for each dataset to ensure accountability during system transitions.