In three new decisions, the Danish Data Protection Authority assesses the control has led to the transmission of many information or that has been possible to have access to information of many citizens.

The Danish Data Protection Authority has taken a decision under three cases of security breach of personal data. Common to the cases is that, due to the lack of basic controls, too much information was passed on to the recipients or access was given to information concerning too many citizens.

In two of the cases, it is about information related to the occupation responsible for 1.5 million citizens till 4.2 million citizens. Here, the Danish Data Protection Authority has declared responsibility for serious criticism to societies which were responsible for the personal data process for municipalities.

In this last case, it is about a no intentional disclosure of name, address and social security number when a person has fulfilled a digital request of a municipality for an extra charge or a single performance against another citizen.

This last accident is an example of a case in which the municipality responsible for the data process has not carried out the greatest based control of which information has been disclosed when an IT system has been put into operation. In the same way, in these cases, the data processors did not do the based controls on informations shared after that the system has been modified because of an update.

It is in the opinion of the Data Inspectorate that IT systems must be regularry controlled,therefore it is ensured that the system does not transmit more information than necessary to the appropriate recipients it is ensured that the system does not transmit information to the wrong recipients it is ensured that access control on the system works properly, including that users have access to exactly the information they should have access to;

It is particularly important that these controls are carried out before the system is put into operation for the first time and after a change has been made to the system, for example in connection with an update.

SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA DANIMARCA