The Norwegian Data Protection Authority (DPA) fined the Norwegian Labour and Welfare Administration (NAV) 20 million Norwegian kroner for breaching GDPR regulations. An inspection revealed NAV’s failure to implement adequate technical and organizational measures to protect personal data, including insufficient access controls and log monitoring. NAV’s organizational structure allowed widespread access to sensitive information without proper justification, violating GDPR principles of data minimization and confidentiality. Additionally, the absence of routine risk assessments and inadequate training for administrators further exacerbated the breach. The Norwegian DPA ordered NAV to establish comprehensive measures for compliance and impose technical safeguards.
***
Denmark’s DPA has published an update of the data transfer guidance for third countries. According to the official press release, “the background for the update is the latest development in the field. Since the last update of the guidance, a number of new guidance from the EDPB has therefore been published. In addition, the EU Commission has adopted a new adequacy decision regarding the USA”.
***
France’s DPA (CNIL) fined a retail chain 525,000 euros for having used data purchased from data brokers for marketing purposes, without ensuring that the individuals concerned had given their valid consent. In addition, CNIL found that the company did not allow individuals to be sufficiently informed, thus breaching Article 14 of the GDPR. The amount of the fine, which represents around 2% of the company’s turnover, was decided in the light of the seriousness of the breach and the responsibility assumed by the organisation using the data collected.
Comments are closed.