If Skadeförsäkring AB – Complaint Upheld (Sweden, 2023)

Following a complaint, the Swedish DPA investigated whether an insurance company – If Skadeförsäkring AB – (the controller) had ensured an appropriate level of security pursuant to Article 32 GDPR when sending an email containing sensitive personal data. The e-mail in question contained the controller’s decision on a claims settlement and a medical assessment on which the decision was based. The data subject complained about the fact that they received an email including personal data on their health by the controller via e-mail that was not end-to-end encrypted. It was stated by the controller that the e-mail was encrypted with so-called Enforced Transport Layer Encryption (Enforced TLS-encryption). The controller argued that this implied that the message was encrypted from the controller’s servers to the recipient’s e-mail server. In the course of the investigation, the controller presented to the DPA that it has increased its security by, among other things, developing and launching a new communication solution for emails that are sent to the company’s customers. With the new solution a notification is sent to the customer by e-mail or text message informing the customer that the customer has received a message from the controller that can be read on a specific site “My pages”. In order to log in to “Mypages”, the customer needs to authenticate with the Swedish e-identification “BankID”. The DPA established that the controller is responsible for the security of the processing pursuant to Article 32 GDPR. Therefore, the controller must assess the risks associated with the processing and take appropriate technical and organisational measures to address those identified risks. In this particular case, the DPA identified that the issue is the transfer of sensitive personal data over an open network (internet). The technical and organisational measures to be taken by the controller are subject to enhanced requirements when processing sensitive personal data pursu