Dutch Social Insurance Institution (SVB)
Insufficient technical and organisational measures to ensure information security
Date de décision
19 janvier 2023
Autorité
Dutch Supervisory Authority for Data Protection (AP)
NL
Secteur
Public Sector and Education
Pays
NL
Droit
GDPRStatut
FINALDescription
The Dutch DPA has imposed a fine of EUR 150,000 on the Dutch Social Insurance Institution (SVB). The controller had suffered a data breach in which a client's data had been leaked to unauthorized third parties. An unknown third party had succeeded in requesting benefit information via the controller's telephone helpdesk. In the course of its investigation, the DPA found that the controller had failed to implement sufficient technical and organizational measures to protect personal data. For example, the DPA found that the system for verifying the identity of callers was inadequate and verification questions were too simple.