If Skadeförsäkring AB

What happened

Sending an e-mail containing sensitive data with enforced TLS-encryption instead of end-to-end encryption was deemed insufficient secured under Article 32(1) GDPR. The controller received a reprimand instead of a fine as it had increased the security of its communication solutions.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 9Processing of special categories of personal dataRead →
• Art. 32Security of processing32(1)Read →
• Art. 58Powers58(2)(b)Read →
• Art. 60Cooperation between the lead supervisory authority and the other supervisory authorities concernedRead →

• Data security
• Special categories