The Icelandic Court of Appeal (Landsréttur) confirmed a decision by the data protection authority (Persónuvernd) sanctioning the Directorate of Health for security breaches on a health portal, while substantially reducing the initial fine based on the principle of proportionality.

Facts and context

The Icelandic Court of Appeal (Landsréttur) issued a ruling confirming a sanction decision by the data protection authority (Persónuvernd) against the Directorate of Health, but reducing the fine to 4,500,000 ISK (approximately €30,000), for failures in data security on the "Heilsuvera" information portal.

The case stems from a Persónuvernd decision dated June 27, 2023, which initially fined the Directorate of Health 12,000,000 ISK for security breaches in the "messaging" and "maternal protection" sections of the portal, which allowed users to access personal data, including health data, of other individuals.

Reasons for the decision

The Court confirmed the following breach reproached by the supervisory authority:

• Obligation to ensure the security of processing (Article 32 of the GDPR): The Court recalled that data controllers must ensure an appropriate level of data security, which notably involves implementing processes to regularly test, analyze, and evaluate the effectiveness of security measures. In this case, it was established that such processes had not been satisfactorily implemented and that no specific security assessment had been conducted when adding the "maternal protection" section to the portal. The Court found that the Directorate of Health had been negligent in failing to comply with these obligations, qualifying the breaches as serious due to the sensitive nature of the health data involved.

Authority's decision

Consequently, the Court of Appeal reduced the fine imposed on the Directorate of Health to 4,500,000 ISK (approximately €30,000).

The court justified this substantial reduction of the fine (initially set at 12 million ISK by the authority, then reduced to 8 million in first instance) based on the principle of proportionality. It notably took into account mitigating factors such as the absence of demonstrated harm to the data subjects and the organization's prompt reaction to correct the vulnerabilities upon discovery.

Lessons learned

This decision reminds that:

• The data security obligation requires the implementation of active and regular processes to test, analyze, and evaluate the effectiveness of technical and organizational measures.
• Any major functional evolution of processing, especially when involving sensitive data, must be subject to a dedicated security assessment before deployment.
• The data controller's cooperation after discovering a breach, notably the speed of its reaction to remedy it, and the absence of demonstrated harm to the data subjects, are essential mitigating factors considered by authorities and courts when determining the amount of a fine.