Sanction RGPD Dutch Supervisory Authority for Data Protection (AP) — Dutch Social Insurance Institution (SVB) : 150 k€ (2023)
- Autorité de contrôle
- Dutch Supervisory Authority for Data Protection (AP)
- Pays
- Pays-Bas
- Entreprise / secteur
- Dutch Social Insurance Institution (SVB)
- Montant de l'amende
- 150 k€
- Date de la décision
- 19 janvier 2023
- Fondement juridique
- Art. 32 (1), (2)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Dutch DPA has imposed a fine of EUR 150,000 on the Dutch Social Insurance Institution (SVB). The controller had suffered a data breach in which a client's data had been leaked to unauthorized third parties. An unknown third party had succeeded in requesting benefit information via the controller's telephone helpdesk. In the course of its investigation, the DPA found that the controller had failed to implement sufficient technical and organizational measures to protect personal data. For example, the DPA found that the system for verifying the identity of callers was inadequate and verification questions were too simple.