Datainspektionen (the Swedish DPA) has imposed a fine totalling SEK 200,000 (EUR 18,700) on Swedish Statens Servicecenter, which provides administrative assistance to other authorities and services to private individuals at 113 service offices in Sweden. After receiving several reports regarding an error in the payroll management system of Statens Servicecenter resulting in unauthorised access to personal data, the Swedish DPA began investigating the matter.
The reported error meant that unauthorised individuals could access personal data from authorities using the service center for payroll management, and they could, in part, access personal data about the staff employed at the service center. In reviewing the matter, the DPA established that Statens Servicecenter had not in due time informed the relevant authorities nor reported the matter to the DPA. In addition, the documentation was insufficient.
Statens Servicecenter had spent nearly five months notifying the affected authorities of the incident and nearly three months reporting it to the DPA. In its decision, the DPA stated that when an incident of this nature is detected, it is important to inform the other authorities, who were also data controllers, as soon as possible so that they can report the matter to the DPA and take appropriate measures to minimise any risk. This lack of information led to a fine of SEK 150,000 (EUR 14,000). The fact that the breach was not reported to the Swedish DPA within 72 hours after Statens Servicecenter became aware of the incident led to an additional fine of SEK 50,000 (EUR 4,700).
The decision demonstrates the importance of immediately dealing with a data breach and at the same time reporting such to the relevant DPA so that any damage caused by the breach can be minimised. If a company does not already have a contingency plan for personal data breaches, the decision also demonstrates that this should be a priority.
The decision can be read here (in Swedish).
