UWV (Dutch employee insurance service provider)
- Country
- Netherlands
- Fine
- 900,000 EUR
- Date
- 2019-10-31
- Sector
- Private Sector
- Articles
- Art. 32 GDPR
Insufficient technical and organisational measures to ensure information security
As UWV (the Dutch service provider for employee insurance - "Uitvoeringsinstituut Werknemersverzekeringen") did not use multi-factor authentication when accessing the online employer portal, security was insufficient. Employers and occupational health and safety services were able to access personal health data of employees in an absence system. A fine of EUR 900,000 was imposed if UWV did not provide proper multi-factor authentication by 31 October 2019. This date was postponed by the Dutch DPA to 1 March 2020 at the request of UWV. Authority: Dutch Supervisory Authority for Data Protection (AP)