Sanction RGPD Icelandic data protection authority ('Persónuvernd') — Sjúkratyringur Íslands : 13 k€ (2023)
- Autorité de contrôle
- Icelandic data protection authority ('Persónuvernd')
- Pays
- Islande
- Entreprise / secteur
- Sjúkratyringur Íslands
- Montant de l'amende
- 13 k€
- Date de la décision
- 28 juin 2023
- Fondement juridique
- Art. 5 (1) f), Art. 25, Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Icelandic DPA has imposed a fine of EUR 13,400 on Sjúkratyringur Íslands. During its investigation, the DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data. This included the lack of multi-factor authentication for access to health information and the controller's use of real data in the development of a system. In assessing the fine, it was considered aggravating that a large number of individuals were affected by the security deficiencies. A mitigating factor was the fact that the controller cooperated fully with the investigation and implemented the measures ordered.