# Sjúkratyringur Íslands: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Icelandic data protection authority ('Persónuvernd')
- Date: 2023-06-28
- Original: https://www.enforcementtracker.com/ETid-1933
- Canonical: https://overview.legal/posts/48048
- Topics: Security, Healthcare, Access Controls, Privacy by Design & Default, Controllers, Processing Agreement, Personal Data, Supervisory Authorities, Law Enforcement, Data Controller

## Summary

The Icelandic DPA has imposed a fine of EUR 13,400 on Sjúkratyringur Íslands. During its investigation, the DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data. This included the lack of multi-factor authentication for access to health information and the controller's use of real data in the development of a system. In assessing the fine, it was considered aggravating that a large number of individuals were affected by the

## Full text

The Icelandic DPA has imposed a fine of EUR 13,400 on Sjúkratyringur Íslands. During its investigation, the DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data. This included the lack of multi-factor authentication for access to health information and the controller's use of real data in the development of a system. In assessing the fine, it was considered aggravating that a large number of individuals were affected by the security deficiencies. A mitigating factor was the fact that the controller cooperated fully with the investigation and implemented the measures ordered.

GDPR Articles: Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR
Industry: Health Care

---
Generated by overview.legal · https://overview.legal/posts/48048 · 2026-08-22