Allerød Municipality – Reprimand (Denmark, 2021)

In summer 2021, the Danish DPA investigated the data practices of a number of national municipalities. The controller in this case, the Allerød Municipality, was one of these. The investigation focused on Allerød Municipality's way of administering access rights in the administration of social welfare, in accordance with Article 32 GDPR. First, the DPA asked the controller for a list of systems in which data on natural persons were processed, as well as the municipality's policies on auditing and sampling for unauthorised access attempts. The municipality shared its guidelines on logging and sampling, which stated that samples were taken at different intervals (e.g. 1 month, 2½ months, 5 months, 3 months, etc.) but never more than 6 months apart. After receiving this information, the DPA requested documentation on the random checks the municipality carried out in one of its systems. The Allerød Municipality provided this documentation, which showed that it had carried out log checks on 24 June 2020, 25 September 2020 and 13 August 2021. Following the inspection of Allerød Municipality, the DPA held that whilst the municipality's procedures for random checks of the log in the social administration's systems were generally satisfactory, it had failed to follow its own guidelines in at least one case. The DPA added that in its opinion, carrying out such sampling every six months constitutes the absolute minimum of auditing systems that process a lot of confidential and/or sensitive information, or where the access rights are of a broader nature. Thus, the Danish DPA issued a reprimand against the Allerød Municipality for failing to implement appropriate technical and organisational measures, as required by Article 32(1) GDPR, to ensure the proper administration of welfare.