Sanction RGPD Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) — City of Stockholm : 394 k€ (2020)
- Autorité de contrôle
- Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)
- Pays
- Suède
- Entreprise / secteur
- City of Stockholm
- Montant de l'amende
- 394 k€
- Date de la décision
- 24 novembre 2020
- Fondement juridique
- Art. 5, Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Swedish DPA imposed a fine on the City of Stockholm for data breaches on a school education platform. The platform consists of different subsystems, including a system for monitoring school attendance, a student administration system, an interface for parents and an administration interface for teachers. In one of the subsystems, a lack of ability to restrict user access to the data has allowed a significant number of staff to access information about students using a protected identity. In another sub-system, parents could access information about other students, such as grades relatively easily. Via Google's search engine, it was possible to find links to enter an administrative interface where information about teachers with a protected identity was accessible.
Décision officielle
Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)