- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Høylandet Municipality – €40,200 Fine (Norway, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Høylandet Municipality was fined €40,200 for a data breach where an employee accessed sensitive images containing personal information. This breach happened because the municipality didn't have proper security measures in place to protect that data. This case highlights the importance of having strong data protection practices to avoid costly penalties.
What happened
An employee accessed sensitive image files containing personal information without proper security measures in place.
Who was affected
Individuals whose sensitive information was included in the accessed image files.
What the authority found
The Norwegian DPA found that Høylandet Municipality failed to implement appropriate security measures to protect personal data, violating GDPR requirements.
Why this matters
This ruling emphasizes that organizations must take data security seriously to protect personal information. Small businesses should ensure they have robust security protocols to avoid similar penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 12 March 2026.
Processing notes: articles corrected, national law identified, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Norwegian DPA has imposed a fine of EUR 40,200 on the municipality of Høylandet. The latter had reported a data breach to the DPA in accordance with Art. 33 GDPR. An employee gained access to several image files (bitmap) when she had to create new letter templates and insert an image logo from the file. The image files that the employee had access to contained sensitive information about individuals who had no connection with the municipality of Høylandet. The information included health data among others. The DPA found that the municipality had not implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk to the data subjects. Instead, the municipality stated that it had simply asked employees using the relevant computer program to avoid opening bitmap files that were not created by the municipality. The error has meanwhile been corrected and the municipality has introduced a new internal control system.
Related Enforcement Actions (0)
No other enforcement actions found for Høylandet Municipality in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
20 September 2021
Authority
Datatilsynet (Norway)
Fine Amount
€40,200
About this data
Cite as: Cookie Fines. Høylandet Municipality - Norway (2021). Retrieved from cookiefines.eu
Last updated: