- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Danish Cancer Society – €107,000 Fine (Denmark, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Danish Cancer Society was fined EUR 107,000 for not securing personal data properly, leading to multiple data breaches. This is important because it shows that organizations must take strong security measures to protect sensitive information.
What happened
The Danish Cancer Society failed to implement adequate security measures, resulting in four data breaches involving sensitive personal health data.
Who was affected
At least 1,448 individuals had their personal data compromised, including sensitive health information.
What the authority found
The Danish data protection authority ruled that the organization did not meet the GDPR requirements for appropriate security measures.
Why this matters
This ruling emphasizes the need for organizations to prioritize data security and implement effective measures to protect personal information, especially sensitive health data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Danish DPA has fined the Danish Cancer Society EUR 107,000 for failing to comply with the requirements of the GDPR regarding appropriate security measures. The Danish Cancer Society had reported four data breaches according to Art. 33 GDPR to the DPA. Two of these involved computer thefts, two phishing attacks - and all four were due to the Danish Cancer Foundation's failure to implement technical and organizational measures to ensure a level of security appropriate to the risk to data subjects. A similar personal data breach already occurred in August 2018, when the Foundation fell victim to phishing and spoofing hacking attacks. In this context, the Danish Cancer Society stated that it should increase protection through multifactor authentication, however, this was not implemented. The data of at least 1,448 individuals was compromised, and in several cases it involved sensitive personal health data, including medical history.
Related Enforcement Actions (0)
No other enforcement actions found for Danish Cancer Society in DK
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
29 September 2021
Authority
Datatilsynet (Denmark)
Fine Amount
€107,000
About this data
Cite as: Cookie Fines. Danish Cancer Society - Denmark (2021). Retrieved from cookiefines.eu
Last updated: