# Bergen Municipality: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Norwegian Supervisory Authority (Datatilsynet)
- Date: 2019-03-01
- Original: https://www.enforcementtracker.com/ETid-42
- Canonical: https://overview.legal/posts/46157
- Topics: Security, Education, Public Authority, IP Address, Personal Data, Public Sector, Minors, Supervisory Authorities, Supervision

## Summary

The incident relates to computer files with usernames and passwords to over 35000 user accounts in the municipality’s computer system. The user accounts related to both pupils in the municipality’s primary schools, and to the employees of the same schools. Due to insufficient security measures, these files have been unprotected and openly accessible. The lack of security measures in the system made it possible for anyone to log in to the school’s various information systems, and thereby to acces

## Full text

The incident relates to computer files with usernames and passwords to over 35000 user accounts in the municipality’s computer system. The user accounts related to both pupils in the municipality’s primary schools, and to the employees of the same schools. Due to insufficient security measures, these files have been unprotected and openly accessible. The lack of security measures in the system made it possible for anyone to log in to the school’s various information systems, and thereby to access various categories of personal data relating to the pupils and employees of the schools. The fact that the security breach encompasses personal data to over 35 000 individuals, and that the majority of these are children, were considered to be aggravating factors. The municipality had also been warned several times, both by the authority and an internal whistleblower, that the data security was inadequate.

GDPR Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/46157 · 2026-08-22