Sweden

City of Stockholm

394,000 €

GDPR enforcement action by Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) on 2020-11-24.

Rank · Sector

#20

of 357 in Public Sector and Education

Rank · Sweden

#16

of 46

Rank · All fines

#277

of 3,050

Case details

Authority: Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)
Date: 2020-11-24
Controller / Processor: City of Stockholm
Sector: Public Sector and Education
Quoted Articles: Art. 5 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Swedish DPA imposed a fine on the City of Stockholm for data breaches on a school education platform. The platform consists of different subsystems, including a system for monitoring school attendance, a student administration system, an interface for parents and an administration interface for teachers. In one of the subsystems, a lack of ability to restrict user access to the data has allowed a significant number of staff to access information about students using a protected identity. In another sub-system, parents could access information about other students, such as grades relatively easily. Via Google's search engine, it was possible to find links to enter an administrative interface where information about teachers with a protected identity was accessible.

Open original source Links to the regulator's original publication or another source.