Trygg-Hansa: Non-compliance with general data processing principles
€3,000,000 fine - Data Protection Authority of Sweden
Content
The Swedish DPA has fined Trygg-Hansa EUR 3 million for serious data security breaches. The security breach was discovered when a recipient of an email from Trygg-Hansa realized that by changing a web link, they could access other customers' documents without authentication. Due to these security breaches, it was possible to access sensitive data of about 650,000 customers, including health, financial and contact information, over a span of more than two years, from October 2018 to February 2021. The DPA found that Trygg-Hansa had failed to implement adequate technical and organizational measures to protect personal data, which allowed such an incident to occur.
GDPR Articles: Art. 5 (1) f) GDPR, Art. 32 (1) GDPR
Industry: Finance, Insurance and Consulting