- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Lillestrøm Municipality – €30,000 Fine (Norway, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Lillestrøm Municipality in Norway was fined EUR 30,000 for accidentally publishing a document that included personal data of students. This breach happened because the data was not detected during several quality checks. The ruling highlights the importance of proper data protection measures for organizations handling personal information.
What happened
Lillestrøm Municipality published a document containing personal data of students without proper safeguards.
Who was affected
Students whose names, birth dates, test results, and behavioral assessments were included in the published document.
What the authority found
The Norwegian Data Protection Authority found that the municipality failed to implement adequate measures to protect personal data, violating GDPR requirements.
Why this matters
This case emphasizes the need for organizations to have strong data protection practices in place. It serves as a warning that negligence in data handling can lead to significant fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 13 March 2026.
Processing notes: national law identified, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Norwegian DPA has imposed a fine of EUR 30,000 on Lillestrøm Municipality. The municipality had accidentally published a document in which 10 out of 21 attachments contained personal data of students. The data included information on student names, date of birth, test results, assessments of student behavior and student challenges. This error was not detected by the responsible administrator and went through two more manual quality checks at the documentation center without the error being detected there as well. It was only a journalist who later drew attention to the data breach. During its investigation, the DPA found that the municipality had not taken sufficient technical and organizational measures to protect personal data. Also, the fact that the incident was discovered not by the municipality, but by a third party, indicates inadequate routines in this area.
Related Enforcement Actions (0)
No other enforcement actions found for Lillestrøm Municipality in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
2 February 2022
Authority
Datatilsynet (Norway)
Fine Amount
€30,000
About this data
Cite as: Cookie Fines. Lillestrøm Municipality - Norway (2022). Retrieved from cookiefines.eu
Last updated: