- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Indre Østfold kommune (municipality) – €17,400 Fine (Norway, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Indre Østfold kommune accidentally published a former student's confidential school folder online, allowing anyone to download it. This is important because it shows that municipalities must protect sensitive information from being publicly accessible. The ruling reinforces the need for proper data security measures.
What happened
The municipality published a confidential school folder online, which was accessible to the public.
Who was affected
A former student whose confidential school records were made publicly available.
What the authority found
The Norwegian data protection authority found that the municipality breached data security requirements by failing to protect confidential information.
Why this matters
This incident underscores the importance of data security for public entities. It serves as a warning for organizations to ensure that sensitive information is not improperly disclosed.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 13 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A former student asked a school to share their school folder. The municipality's routine is to keep records for access requests, which meant, in this case, that the folder was scanned and made available for access. It was, however, made openly available on their website and a local journalist was able to download the entire folder with its contents. The information was confidential, cf. the Education Act. When the error was discovered, the folder was removed and the municipality notified the DPA of the personal data breach, as well as the affected data subject. Was publishing the student's school folder online a breach of Article 32? The DPA concluded that the municipality had breached the required information security requirements as per Article 32(1)(b), cf. Article 5, and that they didn't have any legal grounds for this processing as per Article 6, cf. Article 5 (the latter because the information was confidential and should never have been published openly). The municipality was fined €18,860.
Related Enforcement Actions (0)
No other enforcement actions found for Indre Østfold kommune (municipality) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
16 November 2020
Authority
Datatilsynet (Norway)
Fine Amount
€17,400
200,000 NOK
GDPRhub ID
gdprhub-2966About this data
Cite as: Cookie Fines. Indre Østfold kommune (municipality) - Norway (2020). Retrieved from cookiefines.eu
Last updated: