Sjúkratyringur Íslands: Insufficient technical and organisational measures to ensure information security

The Icelandic DPA has imposed a fine of EUR 13,400 on Sjúkratyringur Íslands. During its investigation, the DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data. This included the lack of multi-factor authentication for access to health information and the controller's use of real data in the development of a system. In assessing the fine, it was considered aggravating that a large number of individuals were affected by the security deficiencies. A mitigating factor was the fact that the controller cooperated fully with the investigation and implemented the measures ordered.

Industry: Health Care