- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Region of Syddanmark – €67,900 Fine (Denmark, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Danish DPA fined the Region of Syddanmark for not securing personal data properly, which allowed unauthorized access to sensitive information. This breach involved health data of over 30,000 children. The fine serves as a warning for organizations to prioritize data security.
What happened
The Region of Syddanmark was fined for failing to implement adequate security measures for personal data.
Who was affected
Over 30,000 children whose health information was stored in an insecure database.
What the authority found
The DPA found that the region did not comply with its obligation to protect personal data, leading to unauthorized access.
Why this matters
This case underscores the critical need for organizations to implement strong data security measures to protect sensitive information from breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 12 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Danish DPA (Datatilsynet) has fined the Region of Syddanmark EUR 67,900 for failing to comply with its obligation as a data controller to implement adequate security measures. The matter came to the attention of the DPA when a citizen complained to the authority in 2020 about the lack of security in the processing of personal data of the citizen's child by the region, and shortly thereafter the region reported the matter to the authority as a personal data breach. The Region of Syddanmark had maintained a database for research and clinical purposes for a period of more than 1.5 years, whereby the database was not adequately secured against unauthorized access. By manipulating URLs, it was possible to gain access to PDF documents stored in the database. This allowed citizens who were registered in the database - and who also had a login to the database - to access the personal data of people registered in the database. The database contained questionnaires with health information on more than 30,000 children receiving psychiatric care.
Related Enforcement Actions (0)
No other enforcement actions found for Region of Syddanmark in DK
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
16 July 2021
Authority
Datatilsynet (Denmark)
Fine Amount
€67,900
Enforcement Tracker ID
ETid-759
About this data
Cite as: Cookie Fines. Region of Syddanmark - Denmark (2021). Retrieved from cookiefines.eu
Last updated: