News · IAPP EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Norway's DPA fines medical device company for breach notification violation

Notification Obligation Data Breaches Fines Processing Agreement Healthcare Supervisory Authorities Personal Data Security
Mar 22, 2023 Source
Summary

> Norway's data protection authority, the Datatilsynet, fined U.S.-based Argon Medical Devices 2.5 million kroner for failing to report a July 2021 data breach within the 72-hour deadline required by the EU General Data Protection Regulation. "This case is an important reminder that data controllers — including those established outside the (European Economic Area) — must have suitable measures in place to be able to immediately determine whether a breach of personal data

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Enforcement Booking.com B.V.: Insufficient fulfilment of data breach notification obligations Autoriteit Persoonsgegevens

Full text

Norway's data protection authority, the Datatilsynet, fined U.S.-based Argon Medical Devices 2.5 million kroner for failing to report a July 2021 data breach within the 72-hour deadline required by the EU General Data Protection Regulation. "This case is an important reminder that data controllers — including those established outside the (European Economic Area) — must have suitable measures in place to be able to immediately determine whether a breach of personal data security has taken place, and to immediately notify the supervisory authority and the data subject," the DPA said.
Full Story

Original document at the source iapp.org

Similar Content