- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Bergen Municipality – €170,000 Fine (Norway, 2019)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Bergen Municipality faced a fine for failing to protect sensitive information, including usernames and passwords for over 35,000 accounts. This matters because the lack of security put personal data, especially of children, at risk. The ruling serves as a warning for municipalities to improve their data security measures.
What happened
Bergen Municipality left usernames and passwords for over 35,000 user accounts unprotected and accessible.
Who was affected
Pupils and employees of primary schools in Bergen Municipality were affected by the data breach.
What the authority found
The authority determined that Bergen Municipality violated data protection rules by not implementing adequate security measures.
Why this matters
This ruling highlights the critical need for municipalities to enhance their data security practices, especially when handling sensitive information about children. Other local governments should take this as a cue to strengthen their cybersecurity protocols.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The incident relates to computer files with usernames and passwords to over 35000 user accounts in the municipality’s computer system. The user accounts related to both pupils in the municipality’s primary schools, and to the employees of the same schools. Due to insufficient security measures, these files have been unprotected and openly accessible. The lack of security measures in the system made it possible for anyone to log in to the school’s various information systems, and thereby to access various categories of personal data relating to the pupils and employees of the schools. The fact that the security breach encompasses personal data to over 35 000 individuals, and that the majority of these are children, were considered to be aggravating factors. The municipality had also been warned several times, both by the authority and an internal whistleblower, that the data security was inadequate.
Related Enforcement Actions (1)
Other enforcement actions involving Bergen Municipality in NO
Details
Fine Date
1 March 2019
Authority
Datatilsynet (Norway)
Fine Amount
€170,000
About this data
Cite as: Cookie Fines. Bergen Municipality - Norway (2019). Retrieved from cookiefines.eu
Last updated: