Enforcement · Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

City of Stockholm: Insufficient technical and organisational measures to ensure information security

€394,000 Fine
City of Stockholm
SWEDEN
Art. 5 GDPR Art. 32 GDPR
Data Breaches Audit Logs Education Security Public Authority Processing Agreement Public Sector Monitoring
Nov 24, 2020 Source

How it connects

Related across sources

Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB News Data Protection Officer or Chief Privacy Officer?The rise of the Data Protection Officer White Label Consultancy Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review

Full text

The Swedish DPA imposed a fine on the City of Stockholm for data breaches on a school education platform. The platform consists of different subsystems, including a system for monitoring school attendance, a student administration system, an interface for parents and an administration interface for teachers. In one of the subsystems, a lack of ability to restrict user access to the data has allowed a significant number of staff to access information about students using a protected identity. In another sub-system, parents could access information about other students, such as grades relatively easily. Via Google's search engine, it was possible to find links to enter an administrative interface where information about teachers with a protected identity was accessible.

Industry: Public Sector and Education

Original document at the source www.datainspektionen.se

Similar Content