Breiðholt Upper Secondary School
€9,000
Insufficient technical and organisational measures to ensure information security
Date de décision
10 mars 2020
Autorité
Icelandic data protection authority ('Persónuvernd')
IS
Secteur
Public Sector and Education
Pays
IS
Droit
GDPRStatut
FINALDescription
In violation of Art. 32 GDPR, a teacher had sent an e-mail to his students and their parents with an attachment containing data on their well-being, academic performance and social conditions.
Citations légales
Art. 5 (1)Art. 32
Questions et violations
Insufficient technical and organisational measures to ensure information security