Background information
- Date of final decision: 23 April 2025
- National case
- Controller: the Equality Ombudsman (DO)
- Legal Reference (s): Article 32 (Security of processing), Article 83 (General conditions for imposing administrative fines)
- Decision: administrative fine
- Key words: administrative fine, data security, restriction of processing, personal data breach, public administration, sensitive data
Summary of the Decision
Origin of the case
The Equality Ombudsman (DO), the Swedish agency to promote equal rights and opportunities and to combat discrimination, has reported a personal data breach to the Swedish Supervisory Authority (SA). The notification states that personal data collected via DO's web form for collecting tips and complaints about discrimination, could be included in usage analyses of the DO's website. The breach was reported to the Swedish SA in the fall of 2021.
Key Findings
Swedish SA´s supervision of the breach shows that the DO had taken a security measure intended to protect the personal data collected via the web form so that the data would not be included in usage analyses of the DO's website. However, the security measure did not work as intended, which lead to some data, potentially sensitive personal data, being inadvertently disclosed to the personal data processor that the DO had hired to conduct the analyses.
The incident lasted for a year and shows the importance of working continuously and systematically with security in order to be able to discover insufficient security measures earlier. It is estimated that approximately 500 tips and complaints have been affected. After discovering the incorrect handling of data, DO closed the web form.
Decision
The DO has violated the general data protection regulation (GDPR) by not having taken sufficiently effective security measures to ensure an appropriate level of security for the web form for collecting tips and complaints about discrimination. Swedish SA issues an administrative fine of SEK 100 000 (approximately 9 000 EUR).
For further information:
- National decision: Sanktionsavgift mot Diskrimineringsombudsmannen när personuppgifter samlats in via ett webbformulär | IMY (Swedish)