Statens pensjonskasse (SPK - The Norwegian Public Service Pension Fund) – €87,000 Fine (Norway, 2021)

The Norwegian Public Service Pension Fund (SPK - Statens pensjonskasse) reported a personal data breach in September 2019. Between 2016-2019, they obtained a large amount of personal data from the Norwegian Tax Administration, much of which was not needed for their purpose. The data was meant to be used for correcting disbursed disability pensions. However, SPK lacked a filter to prevent receiving and storing unnecessary data, as well as organisational measures for deleting the superfluous data. SPK themselves categorized the breach as serious, as it involved processing highly sensitive personal data about a vulnerable group of people (those receiving disability pensions). In total, about 44,000 people were affected by the breach, of which about 24,000 receiving disability pension. First, the DPA stated that, although the SPK could rely on both Article 6(1)(c) and Article 6(1)(e) GDPR, the processing must have been necessary. The same necessity requirement follows from Article 9(2)(b) GDPR, since SPK processed health data. Because SPK processed unnecessary income information that was obtained from the Tax Authority, the necessity requirement was not met, in violation of Article 6(1) and Article 9(2) GDPR. In addition, the DPA found that the Public Service Pension Fund (SPK) had obtained excess personal data not needed for the purpose of calculating correct disability pension disbursements, in breach of Article 5(1)(c) GDPR. Lastly, SPK lacked sufficient routines for assessing what personal data was needed and for deleting superfluous data, in breach of Article 5(1)(e) GDPR. Although the DPA found that the violations were not found intentional, but negligent, and SPK took measures to limit the damage, SPK violated basic principles of the GDPR, special categories of personal data were involved, and a large number of persons was affected. Hence, the DPA concluded that SPK needed to be fined, and considered the fine of € 99,940 (NOK 1 million) to be sufficient.