Norway

Municipality of Oslo

39,000 €

GDPR enforcement action by Norwegian Supervisory Authority (Datatilsynet) on 2021-05-20.

Rank · Sector

#80

of 357 in Public Sector and Education

Rank · Norway

#24

of 53

Rank · All fines

#852

of 3,050

Case details

Authority: Norwegian Supervisory Authority (Datatilsynet)
Date: 2021-05-20
Controller / Processor: Municipality of Oslo
Sector: Public Sector and Education
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 39,000 on the Municipality of Oslo. On a website of the controller a subpoena from the public prosecutor's office concerning the data subject had been published. The subpoena contained, among other things, personal information such as health data. The incident occurred because the subpoena was not originally classified as confidential and accordingly was not exempted from public disclosure. The document was publicly available for five hours before it was removed.

Open original source Links to the regulator's original publication or another source.