The Netherlands

UWV (Dutch employee insurance service provider)

900,000 €

GDPR enforcement action by Dutch Supervisory Authority for Data Protection (AP) on 2019-10-31.

Rank · Sector

#31

of 322 in Finance, Insurance and Consulting

Rank · The Netherlands

of 43

Rank · All fines

#180

of 3,050

Case details

Authority: Dutch Supervisory Authority for Data Protection (AP)
Date: 2019-10-31
Controller / Processor: UWV (Dutch employee insurance service provider)
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

As the UWV (the Dutch employee insurance service provider - "Uitvoeringsinstituut Werknemersverzekeringen") did not use multi-factor authentication when accessing the online employer portal, security was inadequate. Employers and health and safety services were able to collect and display health data from employees in an absence system.

Open original source Links to the regulator's original publication or another source.