Bergen Municipality
- Country
- Norway
- Fine
- 170,000 EUR
- Date
- 2019-03-18
- Sector
- Public services
- Articles
- Art. 5 (1) f) GDPRArt. 32 GDPR
Failure to implement sufficient measures to ensure information security
The municipality had taken minor security precautions to protect its computer systems. As a result, personal data of more than 35,000 people became publicly available. At a few schools, everyone could access information about the staff, students and employees of the school. Furthermore, the municipality had received warnings about the weakness of its security measures before, but did nothing about it. Authority: Norwegian Data Protection Authority (Datatilsynet)