Enforcement
EN Breiðholt Upper Secondary School: Insufficient technical and organisational measures to ensure information security
€9,000 fine - Icelandic data protection authority ('Persónuvernd')
Content
In violation of Art. 32 GDPR, a teacher had sent an e-mail to his students and their parents with an attachment containing data on their well-being, academic performance and social conditions.
GDPR Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR
Industry: Public Sector and Education