Danish DPA fines Sirius Lawyers DKK 500,000 for inadequate security after hacker attack
A law firm was exposed to a hacker attack.
Original title: Datatilsynet (Denmark) - 2022-63-0003
Holding
The Danish DPA held that the law firm lacked basic security measures, especially considering the fact that its processing involved special categories of personal data. The DPA emphasized that in such cases a data breach would almost certainly entail a high risk to the data subjects' rights. Therefore, the controller must have especially strict security measures in place to avoid unauthorised accesses. Hence, when creating remote access to such IT systems, the controller could, for instance, implement multifactor authentication. Consequently, the DPA reported the firm to the police. The DPA assessed the appropriate sanctions in accordance with Article 83(2) GDPR and suggested a fine of approximately €67,000 (DKK 500,000).
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
Thereby, hackers received access to the firm's servers that contained personal data and encrypted them. This posed a serious risk that the personal data was accessed by unauthorized persons, with a potential for harm to the data subjects. In March 2020, the law firm notified the Danish DPA of the data breach.
Full text 3 findings
Machine translation of the decision, via GDPRhub — not the official text. Read the original
SIRIUS lawyers are fined Particularly protected personal data was compromised when SIRIUS lawyers were subjected to a hacker attack. Due to lack of security measures, the Danish Data Protection Agency has reported the company to the police and recommended a fine of DKK 500,000. SIRIUS lawyers have been fined DKK 500,000 for not implementing very basic security measures when setting up remote access to the company's IT systems with personal data of a particularly protected nature. In March 2020, SIRIUS lawyers reported a breach of personal data security to the Danish Data Protection Agency, after they were subjected to a hacker attack. During the attack, hackers gained access to and encrypted the law firm's servers, which contained information about the company's clients and counterparts. This created a serious risk that the information about the persons came into the hands of unauthorized persons with potential damage to the persons in question as a result.
Lack of basic safety precautions “Law firms naturally process a lot of information that requires special protection. In this case, SIRIUS lawyers have lacked basic security measures, and this unfortunately meant that i.a. clients' information was compromised. You can not protect yourself 100% against hacker attacks, but the rules in the GDPR require that you make an effort to avoid what is equivalent to the risk, "says Betty Husted, clerk in the Danish Data Protection Agency. In systems with a large number of personal data of a particularly protected nature, where compromise will involve a high risk to the data subjects' rights, the data controller must have specially qualified security measures to ensure that unauthorized access to personal data does not occur. Thus, when creating remote access to such IT systems, one must have implemented verification measures, such as. multifactor login.
Why police report? The Danish Data Protection Agency always makes a concrete assessment of the seriousness of the case pursuant to Article 83 (1) of the Data Protection Regulation. 2, in assessing which sanction is, in the opinion of the Authority, the correct one. In assessing that a fine should be imposed, the Danish Data Protection Agency has emphasized that SIRIUS lawyers had not implemented the security measures that are at least expected when using remote access to systems that, if compromised, would involve a high risk for the data subjects' rights. In its recommendation on the size of the fine, the Danish Data Protection Agency has, among other things, emphasized the nature and seriousness of the infringement and the regulation's requirement that a fine in each individual case must be effective, proportionate to the infringement and have a deterrent effect. Furthermore, it has been concluded, among other things, that SIRIUS lawyers were in the process of implementing a multifactor authentication solution at the time of the breach. At the same time, the Danish Data Protection Agency has emphasized that SIRIUS lawyers have acted extremely cooperatively in relation to the information in the case.