Sanction RGPD Data Protection Authority of Sweden — Trygg-Hansa : 3,0 M€ (2023)
- Autorité de contrôle
- Data Protection Authority of Sweden
- Pays
- Suède
- Entreprise / secteur
- Trygg-Hansa
- Montant de l'amende
- 3,0 M€
- Date de la décision
- 28 août 2023
- Fondement juridique
- Art. 5 (1) f), Art. 32 (1)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Swedish DPA has fined Trygg-Hansa EUR 3 million for serious data security breaches. The security breach was discovered when a recipient of an email from Trygg-Hansa realized that by changing a web link, they could access other customers' documents without authentication. Due to these security breaches, it was possible to access sensitive data of about 650,000 customers, including health, financial and contact information, over a span of more than two years, from October 2018 to February 2021. The DPA found that Trygg-Hansa had failed to implement adequate technical and organizational measures to protect personal data, which allowed such an incident to occur.