- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Civilstyrelsen – €13,400 Fine (Denmark, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Danish agency Civilstyrelsen was fined EUR 13,400 after losing a USB stick containing sensitive information. This incident is significant because it shows the need for organizations to protect personal data and follow proper security measures. Companies should prioritize data security to avoid breaches.
What happened
Civilstyrelsen lost an unencrypted USB stick that contained over 800 pages of sensitive information.
Who was affected
Individuals whose sensitive information was stored on the lost USB stick.
What the authority found
The Danish data protection authority determined that Civilstyrelsen failed to implement adequate security measures to protect personal data.
Why this matters
This ruling highlights the importance of encrypting sensitive data and having clear policies for data handling. Organizations must take proactive steps to secure personal information to prevent similar incidents.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Danish DPA has imposed a fine of EUR 13,400 on the Danish agency Civilstyrelsen. A Civilstyrelsen USB stick containing more than 800 pages of sensitive and confidential information had been lost. During its investigation, the DPA found that the USB stick was not encrypted. In addition, the agency did not have any policies for its employees on the use of removable and portable media. Moreover, the DPA found that despite being aware of this data breach, the agency had not reported the breach, contrary to its obligation under Art. 33 GDPR. The DPA concluded that the agency had not taken appropriate technical and organizational measures to protect personal data. Encryption of removable media, for example, is a necessary and required security measure, especially if the removable media contain sensitive information such as personal data.
Related Enforcement Actions (0)
No other enforcement actions found for Civilstyrelsen in DK
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
12 May 2022
Authority
Datatilsynet (Denmark)
Fine Amount
€13,400
Enforcement Tracker ID
ETid-1161
About this data
Cite as: Cookie Fines. Civilstyrelsen - Denmark (2022). Retrieved from cookiefines.eu
Last updated: