Sanction RGPD Danish Data Protection Authority (Datatilsynet) — Vejle Municipality : 27 k€ (2021)
- Autorité de contrôle
- Danish Data Protection Authority (Datatilsynet)
- Pays
- Danemark
- Entreprise / secteur
- Vejle Municipality
- Montant de l'amende
- 27 k€
- Date de la décision
- 16 juin 2021
- Fondement juridique
- Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Danish DPA (Datatilsynet) has imposed a fine of EUR 27,000 on Vejle municipality. The Danish DPA had started investigations against the municipality after it had reported a data breach pursuant to Art. 33 GDPR. The municipal dental care service had sent automated welcome letters to both parents as part of the treatment of children, which contained the contact details of both parents. In this process, the municipality had not checked whether it was permitted to pass the information on to the other parent. In several cases, parents thus received the address of the other parent, regardless of whether the other parent had name and address protection. The DPA considered this to be a failure of the municipality to take technical and organizational measures to ensure adequate data protection.