Lolland municipiality: Insufficient technical and organisational measures to ensure information security

The Danish DPA has imposed a fine of EUR 6,700 on Lolland municipiality. The municipality had reported a data breach to the DPA in accordance with Art. 33 GDPR. One of the municipality's employees had their work phone stolen. The employee used the phone to access their work email account which contained information on the names of several citizens, social security numbers and health data. During its investigation, the DPA found that the phone was not protected by a password. Therefore, it was possible to access the information stored on the phone. The DPA concluded that this incident had occurred due to the municipality's failure to take sufficient technical and organizational measures to protect personal data. The municipality should have ensured, at least, that each employee secured their cell phone with a password.

Industry: Public Sector and Education