Enforcement · Norwegian Supervisory Authority (Datatilsynet) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Østre Toten municipality: Insufficient technical and organisational measures to ensure information security

€412,000 Fine
Østre Toten municipality
NORWAY
Art. 5 GDPR Art. 32 GDPR
Encryption Access Controls Security Audit Logs Religious Beliefs Public Authority Healthcare Education
Oct 18, 2021 Source

How it connects

Related across sources

Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Case Law Meta Platforms v noyb CJEU News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD Case Law GC and Others v CNIL CJEU Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 01/2021 EDPB

Full text

The Norwegian DPA has fined Østre Toten municipality EUR 412,000. The municipality suffered a cyberattack in January 2021, as a result of which the municipality's data was encrypted as well as backups were deleted. A larger amount of data was later published on the dark web. Approximately 30,000 documents were affected by the attack. The documents contained, among other things, information on ethnic origin, political opinion, religious beliefs, union memberships, sexual orientation, health status, as well as banking data of the municipality's residents and employees. The DPA's investigation revealed that the municipality had fundamental deficiencies in the security of personal data and related internal controls.Among other things, the municipality had not used two-factor authentication when logging into systems, and lacked appropriate backup systems.

Industry: Public Sector and Education

Original document at the source www.datatilsynet.no

Similar Content