# UWV (Dutch employee insurance service provider): Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Autoriteit Persoonsgegevens
- Date: 2021-05-31
- Original: https://www.enforcementtracker.com/ETid-751
- Canonical: https://overview.legal/posts/46866
- Topics: Security, Insurance, Healthcare, IP Address, Employees, Supervisory Authorities, Processing Agreement, Supervision

## Summary

The Dutch DPA (AP) has fined UWV (the Dutch employee insurance service provider - 'Uitvoeringsinstituut Werknemersverzekeringen) EUR 450,000. The UWV had not properly secured the sending of group messages via the 'My Workbook' environment. This is a personal environment on the UWV website where job seekers have contact with the UWV. As a result, there were multiple data leaks of personal information, including health information, from a total of more than 15,000 individuals.

## Full text

The Dutch DPA (AP) has fined UWV (the Dutch employee insurance service provider - 'Uitvoeringsinstituut Werknemersverzekeringen) EUR 450,000. The UWV had not properly secured the sending of group messages via the 'My Workbook' environment. This is a personal environment on the UWV website where job seekers have contact with the UWV. As a result, there were multiple data leaks of personal information, including health information, from a total of more than 15,000 individuals.

GDPR Articles: Art. 32 GDPR
Industry: Finance, Insurance and Consulting

---
Generated by overview.legal · https://overview.legal/posts/46866 · 2026-08-22