Norway

Norwegian Parliament

195,000 €

GDPR enforcement action by Norwegian Supervisory Authority (Datatilsynet) on 2022-03-04.

Rank · Sector

#30

of 356 in Public Sector and Education

Rank · Norway

of 52

Rank · All fines

#373

of 3,042

Case details

Authority: Norwegian Supervisory Authority (Datatilsynet)
Date: 2022-03-04
Controller / Processor: Norwegian Parliament
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 (1) b), d) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Norwegian DPA has fined the Norwegian Parliament EUR195,000.

The parliament had suffered a data breach in which unauthorized persons gained access to the email accounts of members of parliament and parliamentary administrative staff. The attackers had succeeded in siphoning off the data, including personal data on bank accounts, dates of birth and health-related data.
During its investigation, the DPA found that the parliament did not incorporate sufficient security mechanisms, such as two-factor authentication, even though a risk analysis in 2020 had found that this posed a high privacy risk.

For this reason, the DPA found that the parliamentary administration had not taken appropriate technical and organizational measures to achieve a sufficient level of security.

Open original source Links to the regulator's original publication or another source.