The Norwegian Data Protection Authority has decided to fine Høylandet municipality NOK 400,000 (EUR 40,000). Image files containing health data about people with no connection to the municipality were accessible to staff at the health clinic.
The Norwegian Data Protection Authority noted that the municipality did not implement any relevant measures after the non-conformity was discovered.
- We have decided to fine the municipality for fundamental internal deficiencies in its access management. This is a breach of the requirements regarding personal data security in the General Data Protection Regulation, says General-Director Bjørn Erik Thon.
The error has been resolved and the municipality has also introduced a new internal control system.