Sanction RGPD Norwegian Supervisory Authority (Datatilsynet) — Ålesund Municipality : 5 k€ (2021)
- Autorité de contrôle
- Norwegian Supervisory Authority (Datatilsynet)
- Pays
- Norvège
- Entreprise / secteur
- Ålesund Municipality
- Montant de l'amende
- 5 k€
- Date de la décision
- 15 mars 2021
- Fondement juridique
- Art. 32 (1) b), Art. 24 (1), Art. 35
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Norwegian DPA (Datatilsynet) imposed a fine of EUR 4,900 on the municipality of Ålesund. At two schools in Ålesund, teachers asked students to download the training app Strava for physical education classes. The students were then given tasks that the teachers controlled via the tracking function. According to the Norwegian DPA's investigation, this resulted in data breaches because the municipality failed to provide standard procedures for privacy-compliant app use in schools. For example, a data protection impact assessment was not carried out, although this would have been necessary in view of the potential risk to the students. In addition, adequate technical and organizational security measures had not been implemented to ensure the protection of the processing.