Danish Agency for Digitisation – Violation Found (Denmark, 2022)

The controller is the Danish Agency for Digitisation. As the responsible authority, it grants curators reading access to companies’ (digital) mailboxes in cases of bankruptcy, cessation, etc. The controller receives this access from the company e-Boks, a digital platform that, inter alia, manages access to mailboxes. The procedure is as follows: the controller compiles a list of which person/legal entity requests reading access to which mailbox, and provides this list to e-Boks, so that the latter can grant technical access to the mailbox. On 29 March 2021, a law firm contacted the controller because, as trustee, they had received access to a companies’ mailbox. However, the law firm had received access to the mailbox of the wrong company. Hence, the controller had e-Boks, which is the digital platform that provides the controller with access to mailboxes, close access to the mailboxes. On 31 March 2021, the controller notified a personal data breach to the Danish DPA. From the controller’s investigation, it became clear that 26 curators had gotten access to the wrong companies’ digital mailbox. Moreover, the controller found that the data breach was caused because the controller had sent an incorrect list to e-Boks, and claimed that a technical error was the reason for this mistake. However, the controller also claimed there was no procedure in place to check the list for mistakes since, until then, mistakes had never occurred. First, the DPA considered that the controller provides curators/trustees access to a large number of confidential information, and thus, higher requirements are placed on the controller’s diligence to ensure that there is no unauthorised access to the personal data. Moreover, the DPA considered that the controller had a procedure in place where a single human error could lead to major personal data breaches, and that the controller found this procedure sufficient since no errors had previously occurred. The DPA concluded that the controller did not have appropriate organisational and technical measures in place to ensure a level of security appropriate to the risks, and therefore violated Article 32(1) GDPR. The DPA criticised the controller for this violation, but also noted that the controller had implemented a procedure where the lists were checked by multiple people to check for human errors.