Sanction RGPD Danish Data Protection Authority (Datatilsynet) — Lolland municipiality : 7 k€ (2022)
- Autorité de contrôle
- Danish Data Protection Authority (Datatilsynet)
- Pays
- Danemark
- Entreprise / secteur
- Lolland municipiality
- Montant de l'amende
- 7 k€
- Date de la décision
- 11 août 2022
- Fondement juridique
- Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Danish DPA has imposed a fine of EUR 6,700 on Lolland municipiality. The municipality had reported a data breach to the DPA in accordance with Art. 33 GDPR. One of the municipality's employees had their work phone stolen. The employee used the phone to access their work email account which contained information on the names of several citizens, social security numbers and health data. During its investigation, the DPA found that the phone was not protected by a password. Therefore, it was possible to access the information stored on the phone. The DPA concluded that this incident had occurred due to the municipality's failure to take sufficient technical and organizational measures to protect personal data. The municipality should have ensured, at least, that each employee secured their cell phone with a password.