Enforcement · Danish Data Protection Authority (Datatilsynet) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Civilstyrelsen: Insufficient technical and organisational measures to ensure information security

€13,400 Fine
Civilstyrelsen
DENMARK
Art. 32 GDPR Art. 33 GDPR
Encryption Data Breaches Security Public Authority Education Privacy by Design & Default Public Sector Processing Agreement
May 12, 2022 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Case Law VB v Natsionalna agentsia za prihodite CJEU Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance EDPB Annual Report 2022 EDPB

Full text

The Danish DPA has imposed a fine of EUR 13,400 on the Danish agency Civilstyrelsen. A Civilstyrelsen USB stick containing more than 800 pages of sensitive and confidential information had been lost. During its investigation, the DPA found that the USB stick was not encrypted. In addition, the agency did not have any policies for its employees on the use of removable and portable media. Moreover, the DPA found that despite being aware of this data breach, the agency had not reported the breach, contrary to its obligation under Art. 33 GDPR. The DPA concluded that the agency had not taken appropriate technical and organizational measures to protect personal data. Encryption of removable media, for example, is a necessary and required security measure, especially if the removable media contain sensitive information such as personal data.

Industry: Public Sector and Education

Original document at the source www.datatilsynet.dk

Similar Content