Denmark

Lolland municipiality

6,700 €

GDPR enforcement action by Danish Data Protection Authority (Datatilsynet) on 2022-08-11.

Rank · Sector

#205

of 356 in Public Sector and Education

Rank · Denmark

#27

of 29

Rank · All fines

#1,573

of 3,042

Case details

Authority: Danish Data Protection Authority (Datatilsynet)
Date: 2022-08-11
Controller / Processor: Lolland municipiality
Sector: Public Sector and Education
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Danish DPA has imposed a fine of EUR 6,700 on Lolland municipiality.
The municipality had reported a data breach to the DPA in accordance with Art. 33 GDPR. One of the municipality's employees had their work phone stolen. The employee used the phone to access their work email account which contained information on the names of several citizens, social security numbers and health data.

During its investigation, the DPA found that the phone was not protected by a password. Therefore, it was possible to access the information stored on the phone.

The DPA concluded that this incident had occurred due to the municipality's failure to take sufficient technical and organizational measures to protect personal data. The municipality should have ensured, at least, that each employee secured their cell phone with a password.

Open original source Links to the regulator's original publication or another source.