S.Á.Á – Fine (Iceland, 2020)

The case and investigation was opened as a result of a data breach notification sent to Persónuvernd from S.Á.Á. A retired employee, who was the head of the treatment home Vik before retiring, received «a significant amount» of personal data concerning patients, including the detailed medical records of 252 individuals and records of check-ins containing 3,000 names. The personal data was stored in boxes that was sent to the retired employee alongside his belongings. S.Á.Á. did not dispute that a breach of personal data had occurred. However, S.Á.Á. emphasized that the former head packed the boxes himself, and as a former chief he should have been clear about the contents of the boxes. In addition, S.Á.Á. stressed that the incident was related to human error, and that the organization had reviewed their organisational measures to avoid data breaches. In the view of Persónuvernd, the delivery of the medical records was a result of lacking technical and organisational measures. The fact that the former employee had packed the boxes himself did not justify the lack of technical and organisational measures that should have prevented such a disclosure from S.Á.Á. as a controller of the personal data.