The Netherlands

Dutch Social Insurance Institution (SVB)

150,000 €

GDPR enforcement action by Dutch Supervisory Authority for Data Protection (AP) on 2023-01-19.

Rank · Sector

#37

of 356 in Public Sector and Education

Rank · The Netherlands

#24

of 43

Rank · All fines

#405

of 3,042

Case details

Authority: Dutch Supervisory Authority for Data Protection (AP)
Date: 2023-01-19
Controller / Processor: Dutch Social Insurance Institution (SVB)
Sector: Public Sector and Education
Quoted Articles: Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Dutch DPA has imposed a fine of EUR 150,000 on the Dutch Social Insurance Institution (SVB). The controller had suffered a data breach in which a client's data had been leaked to unauthorized third parties. An unknown third party had succeeded in requesting benefit information via the controller's telephone helpdesk. In the course of its investigation, the DPA found that the controller had failed to implement sufficient technical and organizational measures to protect personal data. For example, the DPA found that the system for verifying the identity of callers was inadequate and verification questions were too simple.

Open original source Links to the regulator's original publication or another source.