Sanction RGPD Dutch Supervisory Authority for Data Protection (AP) — UWV (Dutch employee insurance service provider) : 900 k€ (2019)
- Autorité de contrôle
- Dutch Supervisory Authority for Data Protection (AP)
- Pays
- Pays-Bas
- Entreprise / secteur
- UWV (Dutch employee insurance service provider)
- Montant de l'amende
- 900 k€
- Date de la décision
- 31 octobre 2019
- Fondement juridique
- Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
As the UWV (the Dutch employee insurance service provider - 'Uitvoeringsinstituut Werknemersverzekeringen') did not use multi-factor authentication when accessing the online employer portal, security was inadequate. Employers and health and safety services were able to collect and display health data from employees in an absence system.