Sanction RGPD Norwegian Supervisory Authority (Datatilsynet) — Asker Municipality : 100 k€ (2021)
- Autorité de contrôle
- Norwegian Supervisory Authority (Datatilsynet)
- Pays
- Norvège
- Entreprise / secteur
- Asker Municipality
- Montant de l'amende
- 100 k€
- Date de la décision
- 15 mars 2021
- Fondement juridique
- Art. 5, Art. 6, Art. 32 (1) b), Art. 24
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Norwegian DPA (Datatilsynet) has fined the municipality of Asker EUR 100,000. On May 20, 2020, the DPA received a notice that the municipality had unlawfully published personal data on its website. On the website, users could view the names of documents that had previously been sent via the municipality's email distribution list. In addition to the names of the actual document, they also contained the names and dates of birth of 127 people, including children. Although the distribution lists were proofread daily by two people, the municipality had failed to detect the discrepancies. The Norwegian DPA concludes that the data breach occurred partly due to a lack of required routines for handling email lists.