The Danish Data Protection Agency propose for large GDPR fines
The Danish Data Protection Agency propose for large GDPR fines
During the summer of 2021, the Danish Data Protection Agency has imposed fines on three public authorities and two private companies in the range of DKK 150,000 – 600,000 for violating the GDPR legislation. The new size of the fines emphasizes the importance of companies ensuring an adequate level of security when processing personal data.
The summer’s GDPR fines
Vejle municipality, Region of Southern Denmark, the Danish Immigration Service, Nordbornholms Byggeforretning ApS, and Charlottenlund Lægehus Medicals Nordic I/S have, among other, been fined as a result of breaches on the GDPR rules.
The level of fines has generally been lower for public authorities than for private companies. The case concerning the Region of Southern Denmark, which concerned the processing of health information about more than 30,000 children in psychiatry shows, however, that the Danish Data Protection Agency also issues significantly larger fines to public authorities when it comes to security breaches of a more serious nature.
The case in the Region of Southern Denmark in short
In the Region of Southern Denmark case, information about children has been processed for research and clinical purposes. Other citizens who were also registered in the database had for more than 1,5 years had the opportunity to access other people’s information by simply changing an URL. Considering the nature if the security breach, including the fact that there was a large number (30,000) of registered persons who constituted a group of vulnerable children, the Danish Data Protection Agency proposed a fine of DKK 500,000. The case emphasizes that when sensitive information is processed, then the security level should also reflect this.
Similarly, three of the other cases concerned inadequate security measures, while one of the cases concerned the disclosure of information on criminal offenses without authorization.
Larger fines for private companies?
It is to be expected that the level of fines will continue to be lower for public authorities than for private companies, which is partly due to a higher fine limit for private companies in the GDPR and the Data Protection Law. It would therefore be to be expected that a case such as the one mentioned above concerning the Region of Southern Denmark’s processing of sensitive information would have resulted in a higher fine setting if it was a private company.
If you have questions about the processing of personal data or the GDPR legislation, please do not hesitate to contact our GDPR specialist Associated Partner, Attorney Torsten Hylleberg.
