Sanction RGPD Norwegian Supervisory Authority (Datatilsynet) — Østre Toten municipality : 412 k€ (2021)
- Autorité de contrôle
- Norwegian Supervisory Authority (Datatilsynet)
- Pays
- Norvège
- Entreprise / secteur
- Østre Toten municipality
- Montant de l'amende
- 412 k€
- Date de la décision
- 18 octobre 2021
- Fondement juridique
- Art. 5 (1) f), Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Norwegian DPA has fined Østre Toten municipality EUR 412,000. The municipality suffered a cyberattack in January 2021, as a result of which the municipality's data was encrypted as well as backups were deleted. A larger amount of data was later published on the dark web. Approximately 30,000 documents were affected by the attack. The documents contained, among other things, information on ethnic origin, political opinion, religious beliefs, union memberships, sexual orientation, health status, as well as banking data of the municipality's residents and employees. The DPA's investigation revealed that the municipality had fundamental deficiencies in the security of personal data and related internal controls.Among other things, the municipality had not used two-factor authentication when logging into systems, and lacked appropriate backup systems.