Iceland

Sjúkratyringur Íslands

13,400 €

GDPR enforcement action by Icelandic data protection authority ('Persónuvernd') on 2023-06-28.

Rank · Sector

#121

of 270 in Health Care

Rank · Iceland

#16

of 22

Rank · All fines

#1,242

of 3,051

Case details

Authority: Icelandic data protection authority ('Persónuvernd')
Date: 2023-06-28
Controller / Processor: Sjúkratyringur Íslands
Sector: Health Care
Quoted Articles: Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Icelandic DPA has imposed a fine of EUR 13,400 on Sjúkratyringur Íslands. During its investigation, the DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data.
This included the lack of multi-factor authentication for access to health information and the controller's use of real data in the development of a system.

In assessing the fine, it was considered aggravating that a large number of individuals were affected by the security deficiencies. A mitigating factor was the fact that the controller cooperated fully with the investigation and implemented the measures ordered.

Open original source Links to the regulator's original publication or another source.