# Trygg-Hansa: Non-compliance with general data processing principles

- Type: Enforcement
- Source: Data Protection Authority of Sweden
- Date: 2023-08-28
- Original: https://www.enforcementtracker.com/ETid-2021
- Canonical: https://overview.legal/posts/48136
- Topics: Security, Recipient, IP Address, Access Controls, Processing Agreement, Insurance, Healthcare, Privacy by Design & Default, Personal Data, Law Enforcement

## Summary

The Swedish DPA has fined Trygg-Hansa EUR 3 million for serious data security breaches. The security breach was discovered when a recipient of an email from Trygg-Hansa realized that by changing a web link, they could access other customers' documents without authentication. Due to these security breaches, it was possible to access sensitive data of about 650,000 customers, including health, financial and contact information, over a span of more than two years, from October 2018 to February 2021

## Full text

The Swedish DPA has fined Trygg-Hansa EUR 3 million for serious data security breaches. The security breach was discovered when a recipient of an email from Trygg-Hansa realized that by changing a web link, they could access other customers' documents without authentication. Due to these security breaches, it was possible to access sensitive data of about 650,000 customers, including health, financial and contact information, over a span of more than two years, from October 2018 to February 2021. The DPA found that Trygg-Hansa had failed to implement adequate technical and organizational measures to protect personal data, which allowed such an incident to occur.

GDPR Articles: Art. 5 (1) f) GDPR, Art. 32 (1) GDPR
Industry: Finance, Insurance and Consulting

---
Generated by overview.legal · https://overview.legal/posts/48136 · 2026-08-22