Datainspektionen - DI-2019-7024

Datainspektionen - DI-2019-7024
Authority:	Datainspektionen (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5(1)(f) GDPR Article 32(1) GDPR Article 35 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	24.11.2020
Published:	24.11.2020
Fine:	4000000 SEK
Parties:	n/a
National Case Number/Name:	DI-2019-7024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Swedish
Original Source:	Datainspektionen (in SV)
Initial Contributor:	Elisavet Dravalou

The Swedish DPA (Datainspektionen) issued a fine of approximately €392000 at the Educational Board of Stockholm after receiving many complaints that the new IT system "Skolplattformen", used for education administration, has suffered data breaches.

English Summary

Facts

"Skolplattformen" was developed by the Educational Board of Stockholm to help administrate the students and was used for the last years. In the platform there were being processed personal data of 500000 students, education personnel and students' guardians. In the platform, a lot of special categories of personal data were being processed as well as personal data protected by the Swedish Secrecy Law. Four sub-systems were found to have "weak" protection e.g. guardians could access other students' personal data, even those of students with hidden identity.

Dispute

Did the Educational Board of Stockholm breach Articles 32(1) and 35 GDPR with its new IT system which suffered data breaches?

Holding

After receiving many complaints, the Datainspektionen found that the Education Board did not apply adequate technical measures to ensure the security of personal data, which has cause to data breaches and that although the Education Board had carried out DPIAs, these DPIAs did not meet the standards of Article 35 GDPR.

Comment

Building the IT platform "Skolplattformen" was a big project and the total cost of its development costed 675 millions SEK (around €66 millions) while the operating costs were high as well. The reveal of these data breaches created a lot of frustration among Swedes, some of which see it as a bad investment of public money.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

Page 1
Decision
Diarienr
1 (31)
2020-11-23
DI-2019-7024
Postal address: Box 8114, 104 20 Stockholm
E-mail: datainspektionen@datainspektionen.se
Website: www.datainspektionen.se
Phone: 08-657 61 00
City of Stockholm, Board of Education
The education administration
Box 22049
104 22 Stockholm
Supervision according to the EU Data Protection Regulation 2016 / 679-
against the Board of Education in the city of Stockholm

Page 2
The Data Inspectorate
DI-2019-7024
2 (31)
The Data Inspectorate's decision
The infringements
The Data Inspectorate states that the Board of Education in the city of Stockholm has
processed personal data in breach of Article 5 (1) (f) of the Data Protection Regulation 1
requiring adequate security of personal data, including
protection against unauthorized or unauthorized treatment and in breach of Article 32 (1)
which requires the person responsible for personal data to take appropriate technical measures
and organizational measures to ensure a level of security that is
appropriate in relation to the risk to the rights and freedoms of natural persons
by:
• in the module Compulsory school surveillance, during the period 25 May 2018 until
August 27, 2020, had an eligibility award that has been more
more extensive than is necessary in the light of what
each role holder needs to perform their work as well
by unauthorized persons having access to privacy sensitive
personal data concerning students with a protected identity.
• in the subsystem Student documentation, during the period 26 October 2018
until November 2019, unauthorized persons have had access to
personal data concerning a very large number of students, some of whom have
been privacy-sensitive / sensitive personal data.
• in the subsystem Home page for guardians, during the period 27 June
2019 until 24 August 2019, unauthorized persons have had access to
personal data concerning guardians.
• in the subsystem Administration interface, during the period 25 May
2018 until 26 August 2019, unauthorized persons have had access to
privacy-sensitive personal data concerning teachers with protected
identity.
1 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016
on the protection of individuals with regard to the processing of personal data and on that
free movement of such data and repealing Directive 95/46 / EC (General
Data Protection Regulation).

Page 3
The Data Inspectorate
DI-2019-7024
3 (31)
The Data Inspectorate states that the Board of Education in the city of Stockholm,
during the period 25 May 2018 until 27 August 2020, has dealt with
personal data in the subsystems Compulsory school monitoring, Student documentation,
Home page for guardians and the Administration interface in violation of
Article 35, by not having carried out impact assessments for them
system despite the fact that the treatments are likely to lead to a high risk of physical
freedoms and rights of persons as it is a matter of large systems, with
many children registered and with both sensitive and privacy sensitive
personal data.
Administrative penalty fee
The Data Inspectorate decides on the basis of Articles 58 (2) and 83
the Data Protection Ordinance and Chapter 6 Section 2 of the Data Protection Act 2 att
The Board of Education in the City of Stockholm for the violations of Article 5 (1) and
Article 32 (1) of the Data Protection Regulation shall pay an administrative fee
penalty fee of SEK 4,000,000 (four million).
Injunctions
The Data Inspectorate submits pursuant to Article 58 (2) (d)
data protection ordinance education board to implement one as soon as possible
impact assessment in accordance with Article 35 of the Data Protection Regulation
regarding the subsystems Compulsory school surveillance, Student documentation and
Home page for guardians.
The Data Inspectorate submits pursuant to Article 58 (2) (d)
data protection ordinance The Board of Education in the City of Stockholm to limit
eligibility assignments in the module Compulsory schooling for only those
persons who have a need to process personal data in order to perform their
tasks.
2 The Act (2018: 218) with supplementary provisions to the EU Data Protection Regulation

Page 4
The Data Inspectorate
DI-2019-7024
4 (31)
1. Report on the supervisory matter
The Data Inspectorate has through reports of personal data incidents from
The Board of Education in the city of Stockholm has drawn attention to unauthorized persons
access to student information in the School Platform.
From the reports received, it has emerged that the digital platform
used in the city of Stockholm, Skolplattformen, is a city-wide
project and the platform consists of six subsystems. It has also emerged that
The Board of Education in the City of Stockholm is responsible for personal data for them
personal data processing in the School Platform to which the incidents relate.
In the light of these reports, the Data Inspectorate has initiated the relevant case
supervision on 24 June 2019 (dnr 2019-7024) by the Board of Education
processing of personal data, for the purpose of reviewing the security measures for
access to personal data within the framework of two modules of the subsystem
Child and student register:
• Compulsory school monitoring
• Inter-municipal agreements
After the supervision began, the education committee came in with more
reports of personal data incidents. In the light of the information provided by
appeared in these notifications, the Data Inspectorate decided on 18 June 2020
to extend supervision to include a review of security measures
for access to personal data under the subsystems:
• Student documentation
• Home page for guardians (Home page)
• The administration interface “Contact information
teacher ”(Administration interface)
With regard to Intermunicipal agreements, it has emerged that it constitutes a module in
The children and student register. This module has not been fully implemented and
used by a limited number of users. In the module Intermunicipal agreements
there have been nine students. The incident in the module did not include children
protected identity as stated in the notification of the personal data incident.
Against this background, the Data Inspectorate has not examined the module in more detail
Inter-municipal agreements.
Page 5
The Data Inspectorate
DI-2019-7024
5 (31)
When it comes to compulsory schooling, it is a module 3 in Children and
the student register, which constitutes administrative system support for
the Board of Education must be able to fulfill its obligations under the Education Act
(2010: 800). Of the received reports of the personal data incident, it has
it has emerged that unauthorized personnel have had the opportunity to see information about
classified persons. Against this background, the Data Inspectorate has
reviewed the technical measures that the board has taken to ensure one
appropriate security level in the module. The inspectorate has also examined
organizational measures in the form of authorization allocation in the current module.
The incoming personal data incidents regarding the subsystems
Student documentation, the Home page and the Administration interface have touched
technical deficiencies. The Data Inspectorate has therefore only examined the technical ones
measures that have been taken to ensure an appropriate level of safety in these
three subsystems.
The Data Inspectorate's review also refers to the obligation to perform one
impact assessment in accordance with Article 35 of the Data Protection Regulation concerning the
current subsystems.
The Board of Education is responsible for 139 compulsory schools, 32 compulsory special schools, 28
upper secondary schools and six upper secondary special schools. The Data Inspectorate's current
review does not refer to adult education or preschool activities.
2. Justification of decision
2.1 Applicable provisions
The data controller is as defined in Article 4 of the
the Data Protection Regulation a natural or legal person, public authority,
institution or other body alone or together with others
determines the purposes and means of processing personal data; if
the purposes and means of processing are determined by Union law or
national law of the Member States, the controller or
3 The Board of Education has stated that compulsory schooling is both a module and its own
process area.
Page 6
The Data Inspectorate
DI-2019-7024
6 (31)
the specific criteria for appointing him are laid down in Union law or in
national law of the Member States.
According to Article 5 (1) (f) of the Data Protection Regulation, personal data shall be processed on
a way of ensuring adequate security of personal data, including
protection against unauthorized or unauthorized treatment and against loss, destruction or
damage by accident, using appropriate technical or
organizational measures (integrity and confidentiality).
Article 32 (1) of the Data Protection Regulation provides that
the person responsible for personal data shall - taking into account the latest developments,
implementation costs and the nature, scope, context of the treatment
and purposes and the risks, of varying degrees of probability and severity, for
rights and freedoms of natural persons - take appropriate technical and
organizational measures to ensure an appropriate level of security in
relation to the risk. This includes, in accordance with Article 32 (1), points (b) and (d)
the Data Protection Regulation, where appropriate,
- the ability to continuously ensure confidentiality, integrity,
availability and resilience of treatment systems and services,
and
a procedure for regularly testing, examining and evaluating
the effectiveness of the technical and organizational measures to be ensured
the safety of treatment.
Recital 74 of the Data Protection Regulation states:
Personal data controllers should be held responsible for all processing of
personal data which they perform or which is performed on their behalf.
Personal data controllers should in particular be required to take appropriate and
effective measures and be able to show that the treatment is compatible with it
Regulation, including the effectiveness of the measures. One should within these
measures take into account the nature, extent, context and
purposes and the risk to the rights and freedoms of natural persons.
According to Article 35, a data controller shall make an assessment of a
planned processing implications for the protection of personal data, in particular
whether a treatment is to be carried out with new technology and taking into account its nature,
scope, context and purpose are likely to lead to a high risk of
Page 7
The Data Inspectorate
DI-2019-7024
7 (31)
rights and freedoms of natural persons. This includes in accordance with Article 35 (3)
b that an impact assessment pursuant to Article 35 (1) shall be required in particular in cases
processing takes place on a large scale of specific categories of data such as
referred to in Article 9 (1) or of personal data relating to convictions in criminal cases
and infringements referred to in Article 10.
2.2 The responsibility for personal data
What the Education Board in the city of Stockholm stated during the proceedings
The Board of Education in the City of Stockholm is responsible for personal data for them
personal data processing that has taken place in the subsystems Children and
student register (module) Compulsory school monitoring, Student documentation, Start page
and the Administration Interface. However, the Board of Education is not
personal data controller for the personal data processing that has taken place in
the latter subsystem within the framework of preschool activities and
adult education.
The Board of Education currently uses a number of systems and e-services as part of
its educational and administrative activities. The committee is responsible for
operation and development of municipal activities in preschool, primary school,
special primary school, after-school center, upper secondary school and upper secondary special school.
The Board of Education is ultimately responsible for how its own operations
handles the information. Furthermore, the board is responsible for the information
protected in accordance with the city's guidelines for information security and
data protection legislation, such as the Data Protection Regulation. The Municipal Board
is responsible for the system meeting the requirements for security and is the system owner.
Following a decision by the council, the entire responsibility for the School Platform was transferred to
the Board of Education from 1 January 2020. This means that
The Board of Education is both a system owner and an information owner.
The Data Inspectorate's assessment
Nothing in the case contradicts the Board of Education's finding that they are relevant
processing of personal data covered by this supervision has taken place
the purpose of the Board of Education's to conduct municipal school activities.
The same also applies to the Board of Education's view that it is
The Board of Education in the city of Stockholm, which is responsible for personal data for them
personal data processing that has taken place in the subsystems Children and
student register (module) Compulsory school monitoring, Student documentation, Start page
and the Administration Interface. The current supervision does not cover
Page 8
The Data Inspectorate
DI-2019-7024
8 (31)
personal data processing that has taken place within the framework of
preschool activities and adult education, therefore the question falls on
personal data responsibility for the latter processing outside the current one
supervision.
2.3 Compulsory school monitoring
What the Education Board in the city of Stockholm stated during the proceedings
General information about compulsory schooling
The school platform consists of six subsystems and the Children and Pupils' Register constitutes one
of these subsystems. There are 101 modules in the Children and Pupil Register that are
divided into eight process areas. Compulsory schooling is one of the eight
the process areas in the Children and Pupil Register. The process area
Compulsory schooling supports the work with compulsory schooling within
municipal primary schools and regarding pupils in independent schools there
The City of Stockholm is a home municipality. The function also includes the processes
around the municipal activity responsibility. The administrative system support
is used to fulfill the Board of Education's obligations regarding compulsory schooling
according to the Education Act (2010: 800) as well as handling and decisions in matters linked
to this (mainly according to Chapter 7 of the Education Act but also Chapter 24, Section 23). The
Administrative responsibility involves ensuring that students within a certain
geographical area will be located at a school near the home.
The module Compulsory school monitoring processes data on 1,322 active people
compulsory schooling (number of registered) of which 83 students are under seven years. Of
These 1,322 active compulsory school guards have 60 students protected
personal data.
The personal data that is processed in the current module are, among other things. a. name, address,
mother tongue, school placement, guardians and contact information for these
(telephone number and e-mail address) as well as history of school placement and
contacts. Decisions containing personal data are also processed
regarding a specific pupil where compulsory schooling has ceased, continued supervision
(eg imposition of a fine or case with the Swedish Tax Agency), consent to
fulfill compulsory schooling in another way and deferred compulsory schooling (special reasons).
The module contains information that a student goes to a resource school or
special primary school.
Page 9
The Data Inspectorate
DI-2019-7024
9 (31)
Technical deficiencies
On October 5, 2018, it was discovered that all users who had authorization
to the module Compulsory schooling had the opportunity to see all
classified 4 students without school placement. This deficiency is said to be due to
the system lacked logic to in the functionality of compulsory school monitoring
restrict the access of classified persons. The reason for that is
unknown. When the module was implemented in July 2017, the Board of Education had
no knowledge of any deficiencies. Compulsory school surveillance in the city
municipal primary and lower secondary schools are based on residential areas. Privacy marked
people who are unplaced do not have a living area in the system. The routine is that
employees at the schools should not be able to see these students then this processing
only happens centrally.
Number of users who could potentially have been mistaken
classified persons are 1,302. The Board is only aware that
a school administrator incorrectly viewed the information about students marked with privacy.
He must have found three students marked with secrecy in the search results. The
there were a total of 60 students with confidentiality marking in compulsory schooling. It has
It has not been possible to obtain the exact number of users with log history
who had unauthorized access in practice because there are no specific logs
for the module Compulsory school monitoring.
When the defect was discovered on October 5, 2018, it was not verified by users
saw more information than they were authorized to see. On 5 November 2018, ie. one
month after discovery, the board was able to verify that users saw more
information than they were authorized to see. The supplier worked out a correction
which went into production on November 9, 2018.
Organizational shortcomings
Regarding the allocation of qualifications in the Compulsory School Surveillance, the board has
stated that there are eight role holders with different qualifications;
- Gr system manager Sthlm,
- Gr Administrator Remuneration Sthlm,
- Gr Titta Sthlm,
- Gr Administrator Language Center Sthlm,
- Gr PMO-responsible Sthlm,
4 Confidential persons refer to students with protected personal data.
Page 10
The Data Inspectorate
DI-2019-7024
1 0 (31)
- Gr Administrator School Sthlm,
- Gr compulsory schooling Central Admin Sthlm
- Gr Look Economy Sthlm.
The Board stated that four 5 of the eight aforementioned role holders are not
need to have the access to compulsory schooling that they have. This is because
that the education administration cannot see that these role holders need to have
access to compulsory schooling or that it is not guaranteed that
the role only has access to the tasks required to perform
the tasks. The administration has therefore requested that this be adjusted.
The Data Inspectorate's assessment
The nature of the personal data and requirements for security
The Data Inspectorate initially states that in the module
Compulsory school monitoring processes information about students, such as name, address,
social security numbers, guardians and contact information for these
(telephone number and e-mail address), mother tongue, municipality, school location
(school and grade), history of school placement and contact persons (name,
address, social security number, telephone number and e-mail). It is also treated
information about students who have a protected identity. Furthermore, personal data in
some decisions are treated in the module as continued monitoring of a specific student
relating to the imposition of a fine or investigation or matter with the Swedish Tax Agency,
consent to fulfill compulsory schooling in another way (filming, Nordic
schooling or travel abroad) and deferred compulsory schooling (special reasons).
The Data Inspectorate considers that information on protected identity is extensive
worthy of protection / privacy as the risks to the data subjects' freedoms and
rights are great when processing this personal data. Information that a
student attends resource school or special primary school which is also treated in
Compulsory school surveillance is a sensitive personal task 6 as it reveals information about
health.
In view of the nature and nature of the personal data processing which
has taken place in the Compulsory School Surveillance and the risks to the data subjects' freedoms
5 Gr Administrator Remuneration Sthlm, Gr Administrator Language Center Sthlm, Gr PMO-
responsible Sthlm and Gr Look Economy Sthlm.
6, Article 9 of the data protection regulation.
Page 11
The Data Inspectorate
DI-2019-7024
1 1 (31)
and rights, the Data Inspectorate considers that high demands are placed on the technical ones
and organizational measures that the Board of Education had to take to
ensure an appropriate level of safety in accordance with Article 32 i
the Data Protection Regulation.
Technical deficiencies
The investigation in the case shows that unauthorized persons have been able to come
to privacy-sensitive personal data concerning students with protected identities.
Because there is no log follow-up in the module
Compulsory schooling is not possible to state the exact number afterwards
users who have had unauthorized access to this information. The
The technical shortage in compulsory schooling that has now been examined has meant that
Potentially 1,302 users have been able to access personal data without authorization
regarding 60 students with a protected identity. The reason for this depends on
the committee on weaknesses in the system that made restriction of eligibility impossible
to information about students with protected identities. There is no information on when
the shortage occurred but the module was implemented in July 2017 and the shortage
was discovered on October 5, 2018.
Organizational shortcomings
The Data Inspectorate's inspection of the subsystem in question concerns both the requirements
on technical measures and organizational measures in accordance with Article 32. Av
The investigation in the case also shows that the allocation of competence in
Compulsory school monitoring is more extensive than is necessary in
in relation to what each role holder needs to perform theirs
tasks. The Board of Education has stated that a review of the eight
the eligibility roles will be initiated shortly.
Overall assessment
Both the fact that unauthorized persons had access to / have been able to
access privacy-sensitive personal data concerning students with protected
identity and that there is a more extensive access to data in
Compulsory schooling than necessary is contrary to Article 32 (1)
the Data Protection Regulation. According to Article 32 (1), the Board of Education shall include
taking into account recent developments, implementation costs and
the nature, scope, context and purpose of the treatment and the risks of
the rights and freedoms of natural persons, take appropriate technical and
organizational measures to ensure an appropriate level of security in
in relation to the risk.
Page 12
The Data Inspectorate
DI-2019-7024
1 2 (31)
The Data Inspectorate assesses that an appropriate security in this case includes one
ability to continuously ensure the confidentiality of treatment systems
and services. Because the board has allocated more extensively
authorizations and that unauthorized persons have gained access to personal data about
students with a protected identity, it is the Data Inspectorate's assessment that
the Board of Education has failed in its ability to continuously ensure
confidentiality of the data processed in the processing systems and -
services as required by Article 32 (1) of the Data Protection Regulation.
The requirement of adequate security also includes having a procedure for
regularly test, examine and evaluate the effectiveness of the technical and
organizational measures taken to ensure the safety of treatment
which has not been the case here either. The Data Inspectorate finds that
if the Board of Education had had such a procedure to regularly
test, examine and evaluate the effectiveness of the measures taken
the board has been able to ensure / discover whether the technical measures are correct
in accordance with the organizational measures taken. As for it
the lack of organization (the extensive competence) is also according to
The Data Inspectorate's assessment is such a shortcoming in the authorization restriction
which should have been discovered if the Board of Education had regularly
checked the authorization. This too is a shortcoming in the requirements for appropriate security
pursuant to Article 32 (1) of the Data Protection Regulation.
The Board of Education in the City of Stockholm has summarized
personal data in the module Compulsory school monitoring in the School Platform in violation of
Article 32 of the Data Protection Regulation.
The Data Inspectorate also assesses that the Board of Education has considered
personal data in breach of Article 5 (1) (f) of the Data Protection Regulation thereof
current subsystem. This is because the board has not ensured a suitable one
security of personal data, including protection against unauthorized or unauthorized use
treatment through the use of appropriate technical measures.
Page 13
The Data Inspectorate
DI-2019-7024
1 3 (31)
2.4 The student documentation
What the Education Board in the city of Stockholm stated during the proceedings
General information about the Student Documentation
The student documentation is one of six subsystems that the School Platform consists of.
In the subsystem Student Documentation there are a total of 464,611 registered, of which
122,699 are students in municipal primary and secondary school. Of these students
has 787 protected personal data. There are 233,066 in this subsystem
registered guardians and 34,756 employees (some of these employees
works in childcare and adult education not covered by
supervision).
The personal data that is processed in the current subsystem are, among other things. a. rating, result
on national tests, reporting of results to Statistics Sweden, Statistics Sweden,
assessment support that involves documentation of the student's level of knowledge,
information that some students need extra adaptations, documentation
around investigations and action programs, personal data for the work with
development talks and written assessments.
Technical deficiencies
On August 21, 2019, a guardian was discovered via a thread on Twitter
had discovered a data leak in the Student Documentation. The person behind
The Twitter account has analyzed with its own access and login via Bank ID
the traffic and calls between the front-end and back-end systems. 7 The person has
then took out parts of these calls and manipulated them in order to do so
get over other people's information.
7 The terms are used by the Board of Education in the city of Stockholm and their function can
generally described as follows. The separation of front end and back end system simplifies
the data process when it comes to multilayer development and maintenance of computer systems. One
Front-end systems are mainly used to send questions and requests and receive data from
the backend system. It allows users to interact and use one
information system. Usually, front-end systems have very limited computational or
business logic processing functions and relies on data and functions from
the backend system. A front-end system can include or consist of a text or graphic
user interface (GUI) and / or a front-end client application connected to
the backend system. The backend system manages databases and data processing components
and ensures that the responses to the front - end system's requests are retrieved from databases and
data processing components.
Page 14
The Data Inspectorate
DI-2019-7024
1 4 (31)
The board has stated that when logging in takes place in the Student Documentation in
The school platform is exposed to personal data through an API 8 . Due to a technical
lack of API could people, with some knowledge of network systems and
programming, monitor calls made from a logged in client mode, copy
and modify them. In this way, new calls and personal data could be made
which would not be available to the person became available. This means
that personal data was available depending on what requests an individual made
did, regardless of eligibility. This in turn gave access to personal data without
correct authorization.
This shortcoming has meant that unauthorized persons have been able to access it
the following information about other students: first name, last name, social security number,
school type (eg special primary school), year, school ID, class, student's assessment from
module development calls, whether it is an integrated user or not as well
migrated IUP 9 documents from the School Web.
All registered guardians in the School Platform have because of it
current shortage had the opportunity to unauthorized access to information. According to
the Board of Education, a person has taken advantage of this opportunity and done
paging of 101 unique people. The shortcoming has existed since the subsystem
was launched. The module where the shortage existed has been in operation since 26 October
2018 . This deficiency had not been detected in previous function and safety tests
before the function was put into production.
The deficiency in the subsystem was remedied by code changes that were completed
during November 2019 . The student documentation was closed after the shortage
was discovered until all detected deficiencies were rectified.
8 , an application programming interface (API) is a set of protocols, procedures,
functions and / or commands that programmers use to develop
software or facilitate interaction between different systems. APIs are usually
useful for programming GUI components (graphical user interface), as well
as for a program to request and provide services from another program.
9 Individual development plan.
Page 15
The Data Inspectorate
DI-2019-7024
1 5 (31)
The Data Inspectorate's assessment
Security requirements
The Data Inspectorate initially states that in the subsystem
Student documentation in the School Platform is extensive
personal data processing involving thousands of students, guardians and
teacher.
According to Article 9 of the Data Protection Regulation, health information is so-called
sensitive personal data according to the Data Protection Regulation. In preparatory work,
Processing of personal data in the field of education (Bill 2017/18: 218 p.57)
states the following:
As mentioned above, sensitive personal data is further processed
health when examining admission to the special primary school, special school,
upper secondary special school, and special education for adults according to 7, 18 and 21
Cape. the Education Act. Even an indication that a student goes to such a school is one
sensitive task.
The Data Inspectorate further states that in the subsystem Student documentation
data relating to students' health are treated as data contained in
various inquiries about students, special adaptations, etc. Also information about
that some students go to a special school involves the treatment of sensitive
personal data .
In addition, extensive personal data processing is added in
The student documentation that does not constitute sensitive personal data according to
the Data Protection Regulation but is to be regarded as extra privacy sensitive such as
information relating to assessments and data from development interviews.
In view of the scope of the personal data processing that takes place in
the Student Documentation subsystem, the nature and nature of the treatments and
the risks to the data subjects' freedoms and rights, the Data Inspectorate considers
that very high demands should be placed on the technical measures to be taken to
ensure an appropriate level of safety in accordance with Article 32 i
the Data Protection Regulation.
Page 16
The Data Inspectorate
DI-2019-7024
1 6 (31)
Assessment of technical measures
The technical shortcoming in the Student Documentation that is now being examined has meant
that unauthorized persons have been able to access other people's personal data through
to monitor calls made from a logged in client mode, copy and modify
them. In this way, new calls could be made and personal data not
would be available became available. According to the Board of Education
information could be accessed by unauthorized persons, e.g. a. other people's first names,
surname, social security number, type of school (eg special primary school), year, school ID,
class and students' assessments from the module development conversations. This technical
shortage has meant that all registered guardians in the School Platform
has had the opportunity to unauthorized access to information about all registered
students, including sensitive and privacy-sensitive information concerning
students.
The Data Inspectorate notes that the technical security measures that have
taken in the subsystem The student documentation in the School Platform has been
deficient as unauthorized persons have been able to easily access
comprehensive sensitive and privacy-sensitive personal data concerning
thousands of students. The Board of Education has thus breached its obligation
pursuant to Article 32 (1) of the Data Protection Regulation, taking into account the latest
development, implementation costs and the nature, scope of treatment,
context and purpose and the risks to the rights of natural persons and
freedoms, take appropriate technical measures to ensure a level of security
which is appropriate in relation to the risk.
The current technical deficiency which is now being examined in the subsystem
According to the Swedish Data Inspectorate's assessment, the student documentation should have
detected at an early stage, before the processing of personal data
was started. The Data Inspectorate considers that an appropriate security in this case
includes an ability to continuously ensure the confidentiality of
treatment systems and services.
The requirement of adequate security also includes having a procedure for
regularly test, examine and evaluate the effectiveness of the technical
the measures taken to ensure the safety of the treatment. That it
current technical deficiency was discovered by a guardian long after
subsystem The student documentation was launched, shows that the Board of Education
neither has ensured to continuously ensure confidentiality in this
subsystem or had a procedure to regularly test, examine and
Page 17
The Data Inspectorate
DI-2019-7024
1 7 (31)
evaluate the effectiveness of the technical measures taken in a way that:
meets the requirements of the Data Protection Regulation. The Data Inspectorate finds that
this too is a shortcoming in the requirements for appropriate security under Article 32 (1) (i)
the Data Protection Regulation.
In summary, the Board of Education in the city of Stockholm has dealt with this
personal information in the Student Documentation which is part of the School Platform in
in breach of Article 32 of the Data Protection Regulation.
The Data Inspectorate also assesses that the Board of Education has considered
personal data in the subsystem in question in breach of Article 5 (1) (fi)
the Data Protection Regulation. This is because the board has not secured one
appropriate security for personal data, including protection against unauthorized or
unauthorized treatment using appropriate technical measures.
2.5 Home page
What the Education Board in the city of Stockholm has stated during the proceedings
General about the Home page
The start page is one of the six subsystems that the School Platform consists of. A module
in the subsystem The start page is called "contacts" where personal information from School
Data Sync Database (SDS DB) is processed, which in turn retrieves information
from the child and student register subsystem. Personal data is processed to
ensure guardians' access to information about the right school and class
based on the connection between guardians and children / pupils and children / pupils
connection to classes / groups. This is controlled based on information in Children and
student register.
Among the personal data processed in the Home Page are students and teachers
name, e-mail address, school connection, connection to groups, connection to
departments, mentor groups and courses. Data on is also processed
guardian's name, social security number, address, e-mail address, telephone number
and connection to children.
In the subsystem Start page, there are a total of 440,695 registered, of which 31,847 are
employees, 233,062 guardians and 122,699 students in municipal primary and lower secondary school
and high school.
Page 18
The Data Inspectorate
DI-2019-7024
1 8 (31)
Technical shortage
On June 27, 2019, a new functionality was introduced on the Home page there
guardians could apply for other guardians with children in the same class
provided that the guardians have consented to it. August 24th
In 2019, it was discovered that the technical measures had failed then one
guardians by changing calls in the developer tool in their browser
with the help of social security numbers could search for other guardians who
were registered on the Home Page. The shortage has meant that everyone registered
guardians in the School Platform have had the opportunity to take part in unauthorized access
information. This shortcoming has existed since the new functionality was introduced
in June 2019. The Board of Education has identified a guardian who has
access unauthorized information about seven unique people. None of those affected
had a protected identity.
The technical deficiency was remedied on the day it was discovered, on 24 August
2019, through a code change that was produced.
The Data Inspectorate's assessment
Security requirements
The Data Inspectorate initially states that in the subsystem Start page in
The school platform carries out extensive personal data processing that concerns
thousands of students, guardians and teachers. It is treated differently
information such as guardian's social security number, address, e-mail address,
telephone number and connection to children.
In view of the scope of the personal data processing that takes place in
the home system subsystem, the nature and nature of the treatments and the risks to them
The data inspectorate's freedoms and rights, the Data Inspectorate considers that high demands should
technical measures to be taken to ensure an appropriate
security level in accordance with Article 32 of the Data Protection Regulation.
The assessment of technical measures
The technical shortcoming in Startsidan, which is now being examined, has meant that
guardians by changing calls in the developer tool in their browser
with the help of social security numbers could search for other guardians who
are registered on the Home page. This means that guardians have on one
easily accessed unauthorized by other guardians
personal data. The Board of Education has thus breached its obligation
Page 19
The Data Inspectorate
DI-2019-7024
1 9 (31)
pursuant to Article 32 (1) of the Data Protection Regulation, taking into account the latest
development, implementation costs and the nature, scope of treatment,
context and purpose and the risks to the rights of natural persons and
freedoms, take appropriate technical measures to ensure a level of security
which is appropriate in relation to the risk in the subsystem in question.
The Data Inspectorate assesses that an appropriate security in this case includes one
ability to continuously ensure the confidentiality of treatment systems
and services. The current technical shortage should according to
The Data Inspectorate's assessment has been discovered at an early stage before
the processing of personal data began. That the current shortage
was discovered by a guardian after the launch of the Startup subsystem,
shows that the Board of Education also did not have a procedure that fulfills
the requirements of the Data Protection Regulation to regularly test, examine and
evaluate the effectiveness of the technical measures taken. This too is
lack of appropriate security requirements under Article 32 (1) of the Data Protection Regulation.
The Board of Education in the city of Stockholm has thus dealt with
personal data in the subsystem in question in breach of Article 32 i
the Data Protection Regulation.
The Data Inspectorate further assesses that the Board of Education in the city of Stockholm
has processed the personal data in the current subsystem in violation of the article
5.1 in the Data Protection Ordinance because the board has not ensured one
appropriate security for personal data, including protection against unauthorized or
illicit treatment.
2.6 The administration interface
What the Education Board in the city of Stockholm has stated during the proceedings
General information about the Administration Interface
The administration interface was common to the two subsystems
Absence / Attendance and Schedule in the School Platform, where settings for these
subsystems are executed. The system read data from the Children and Pupil Register which is
the source system for basic data in the current subsystem. The data were administered in
this interface and was then shown to users in various interfaces
based on the role of the system and depending on the settings made.
The administration interface was not intended for guardians. People with
Page 20
The Data Inspectorate
DI-2019-7024
2 0 (31)
a combination of roles such as teacher or chancellor who is also
guardians had no access to the information linked to the role
guardian when logging in to this interface. People who only had
however, the role of guardian was given when logging in to the Administration Interface
access to data linked to own children.
Among the personal data handled are name, social security number, e-mail,
telephone number, department or group / class affiliation, teacher connection
to group / class / department, lesson information (group / class / subject / course, room
and time), absence data (presence / absence, reason for absence,
valid / invalid) and the application for leave.
Technical deficiencies
On August 26, 2019, it was discovered that guardians through a search on Google
found links to login to the Administration Interface there
guardians should not be able to log in. The current shortage has meant that
guardians have been able to produce reports for "Contact information teachers"
where name, e-mail address and work telephone number are displayed. Furthermore,
the interface has not been shown to be adapted for handling classified information
tasks. Individuals with protected identities have not had a marking as
reveals this. This means that people with protected identities can have
covered by the current deficiency, but that these can not be distinguished from the others
registered.
The shortcoming has existed since the function was launched, probably since August 2017 .
It was discovered internally on 19 November 2018 and was then assessed by
the Board of Education be trivial because the inquiry then claimed that
no data that the guardian could not see in another interface
was shown. The differences that existed e.g. access to "Contact Information-Teacher",
was then said to only show the student's current teacher and what subjects they have with them
eleven. It was also said that no contact details were shown. The shortage would be solved
with a code merger which was then planned in 2019. The release as
the correction would be covered by early 2019, however, is postponed to the future.
The personal data that was displayed as a result of the current deficiency is
contact information for teachers, such as name, class, school, subject / course, e-
postal address (both work and private address) and telephone number (both work
and private number).
Page 21
The Data Inspectorate
DI-2019-7024
2 1 (31)
It is not possible to determine how many guardians have logged in to this
interface and incorrectly accessed data. It is also not possible to get it
how many of the teachers covered by the reports also had their private e-
postal address entered in the Children and Pupil Register and which could thus be displayed for
unauthorized. The Board of Education cannot state the number of registered as
was affected by this technical deficiency. At present, there are between 50 and 60 teachers
which have a protected identity in this subsystem. The Board of Education can not
nor appreciate what the current shortage has meant for the data subjects
as the board has not received any indications of consequences.
After the vulnerability was discovered and could be confirmed, Stockholm requested
city ​​on 26 August 2019 that the supplier would close the access for
caregiver. The subsystem was shut down and is no longer in operation.
The Data Inspectorate's assessment
Security requirements
The Data Inspectorate initially states that in the Administration Interface
data concerning teachers were processed, such as e-mail address (both work and
private address) and telephone number (both work and private numbers). The
data on teachers with protected identities were also processed.
As previously mentioned, the Data Inspectorate considers that information concerning persons
with protected identities are very worthy of protection / privacy sensitive then the risks
for the data subjects' freedoms and rights are great in processing them
personal data. Given the nature and nature of the
personal data processing that has taken place in the Administration Interface and
the risks to the data subjects' freedoms and rights, the Data Inspectorate considers
that high demands be placed on the technical measures to be taken to
ensure an appropriate level of safety in accordance with Article 32 i
the Data Protection Regulation.
The assessment of technical measures
In the Administration Interface, guardians have via Google search
been able to find links for logging in to the Administration interface there
guardians should not be able to log in. In this interface have guardians
been able to produce information on e.g. a. teachers' private contact details such as
email address and private phone numbers. This interface has also been proven
not be adapted for handling data on individuals with protected
Page 22
The Data Inspectorate
DI-2019-7024
2 2 (31)
identity. This means that unauthorized persons have been able to access
information on persons with a protected identity.
Because the current shortage has meant that unauthorized persons have had
possibility to access information about persons with a protected identity
the Board of Education has breached its obligation under Article 32 (1) (i)
the Data Protection Regulation that, taking into account recent developments,
implementation costs and the nature, scope, context of the treatment
and purposes and the risks to the rights and freedoms of natural persons
appropriate technical measures to ensure an appropriate level of safety in
relation to the risk.
The Data Inspectorate assesses that an appropriate security in this case includes one
ability to continuously ensure the confidentiality of treatment systems
and services. The current technical shortage should according to
The Data Inspectorate's assessment has been discovered at an early stage before
the processing of personal data began. The mentioned shortcoming has
has been around for a long time since the system was launched.
The Board of Education was made aware of the shortcoming in November 2018,
but chose not to remedy it until the deficiency was rediscovered in August
2019. The Board of Education has thus breached the necessity of
continuously ensure confidentiality in the current interface. The requirement of
Appropriate security also includes having a procedure to regularly
test, investigate and evaluate the effectiveness of the technical measures taken
measures to ensure the safety of treatment, which neither has
in this case in the light of the foregoing.
The Board of Education in the city of Stockholm has thus dealt with
personal data in the subsystem in question in breach of Article 32 i
the Data Protection Regulation.
The Data Inspectorate also assesses in this part that the Board of Education has
processed personal data in the current interface in violation of Article 5 (1) (fi)
the Data Protection Ordinance because the board has not ensured an appropriate
security of personal data.
Page 23
The Data Inspectorate
DI-2019-7024
2 3 (31)
2.7 Impact assessment
What the Education Board in the city of Stockholm stated during the proceedings
The Board of Education states that since the Children and Pupil Register
production was launched before 25 May 2018 has no comprehensive
impact assessment under Article 35 of the Data Protection Regulation yet
implemented. On the other hand, impact assessments have been carried out continuously
as new functionalities have been added.
The committee believes that an impact assessment needs to be made and work on
this is ongoing and will be completed in December 2020. The vulnerabilities that have
detected during penetration tests has been promptly remedied.
The Board of Education has further stated that it is working with one
risk management plan, where what is discovered in risk and impact assessments
systematically addressed in accordance with the city's risk matrix and that objective
is that there will soon be active risk management for the whole
The school platform. The Board of Education has a developed process for that
ensure adequate information security that involves risk and
impact assessments shall be carried out
Regarding the Administration Interface, there will be no impact assessment
to be done for this part because the interface has been discontinued and is no longer in
use.
The Data Inspectorate's assessment
In the subsystems and modules that have been the subject of the Data Inspectorate
review treats students, school staff and guardians
personal data of varying degrees of sensitivity. The current subsystems covered
of the supervision in question involves the treatment of a large number
personal data of a large number of data subjects, who are largely children, who in
the Data Protection Regulation is highlighted as vulnerable natural persons 10 .
The Data Inspectorate states that in the relevant subsystems there is extensive
personal data processing with different types of personal data such as grades,
inquiries about students, development talks, special adaptations, children and
adults with a protected identity. Furthermore, sensitive people are also treated
personal data to a certain extent, ie. specific categories of data such as
referred to in Article 9 (1) as health information. It is thus a question of one
10 See recital 75 of the Data Protection Regulation.
Page 24
The Data Inspectorate
DI-2019-7024
2 4 (31)
comprehensive personal data processing if a large number of registered in
the system.
The Data Inspectorate states that it is a question of a treatment as with
consideration of its nature, scope, context and purpose is likely to lead
to a high risk to natural persons rights and freedoms in such a way
which requires that the Board of Education should have implemented one
impact assessment in accordance with Article 35 of the Data Protection Regulation. By article
35.3 (b) further states that an impact assessment under paragraph 1 in particular
shall be required in the case of large-scale treatment of special
categories of data referred to in Article 9 (1). The Data Inspectorate states
that the processing of personal data in the relevant subsystems is of it
the nature set out in Article 35 (3) (b) of the Data Protection Regulation, which is a
circumstance which in particular requires an impact assessment.
The Data Inspectorate has, on the basis of guidelines from Article 29-
working group and the criteria developed by the group 11 , adopted one
list of when an impact assessment is to be made. 12
In addition to the situations referred to in Article 35 (3) of the Data Protection Regulation, and
taking into account the derogation in Article 35 (10), an impact assessment shall
regarding data protection is made if the planned processing meets at least
two of the nine criteria mentioned in the list.
In this case, sensitive data or data is processed by a lot
personal nature, large-scale information and vulnerable information
registered which are three of nine criteria that according to the list suggest that
an impact assessment shall be carried out.
Furthermore, the list indicates when an impact assessment is not required. The
no impact assessment is required for treatments that have
checked by a regulatory authority or a data protection officer in accordance
11 Guidelines on impact assessment regarding data protection and determining whether
the treatment "is likely to lead to a high risk" within the meaning of the Regulation
2016/679, last revised and adopted on 4 October 2017, WP 248 rev. 01.
2 (6) http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236 . The
The European Data Protection Board (EDPB) has approved the guidelines on 25 May 2018
https://edpb.europa.eu/sites/edpb/files/files/news/endorsement_of_wp29_documents.pdf.
12 List according to Article 35 (4) of the Data Protection Ordinance, no. DI-2018-13200
Page 25
The Data Inspectorate
DI-2019-7024
2 5 (31)
with Article 20 of Directive 95/46 / EC and the implementation of which has not changed
since previous control. As a good practice, however, one should
impact assessment is reviewed continuously and evaluated regularly.
The Data Inspectorate finds that there is no circumstance that
suggests that an impact assessment is not required. In the 29-group guidelines
specify that even if an impact assessment is not required on 25 May
In 2018, it is necessary for the person responsible for personal data to perform one
impact assessment, at an appropriate time and as part of its
general liability. 13
The Data Inspectorate states that the processing of personal data takes place
in the current subsystems in the School Platform is likely to lead to a high risk of
the rights and freedoms of natural persons in such a way that a
impact assessment under Article 35 of the Data Protection Regulation
implemented in the respective subsystems covered by this supervision, in order to:
assess the consequences of the planned treatment for the protection of
personal data in accordance with Article 35.
The fact that the system was launched before 25 May 2018 does not affect
the assessment of the inspectorate. The Board of Education states that the reason for
that the current deficiencies that caused the incidents that occurred in the respective
subsystem not discovered before is that no comprehensive
impact assessment has been performed.
In the current review, the Data Inspectorate has assessed that it has existed
technical deficiencies in several subsystems covered by the supervision. The inspection has
also assessed that the eligibility allocations have been more extensive in it
the module where the issue has been examined (Compulsory school monitoring). Against the background of
the Board of Education's own information that has emerged in the case regarding
impact assessment, the Data Inspectorate considers that the Board of Education,
during the period 25 May 2018 until 27 August 2020, has not implemented one
impact assessment covering the compulsory schooling subsystems,
Student Documentation, Home Page and Administration Interface in its
whole. If the board had made a complete impact assessment, so
the deficiencies found could probably have been avoided. The Board of Education
has thus not carried out an impact assessment that meets the requirements of
13 Guidelines on impact assessment regarding data protection and determining whether
the treatment "is likely to lead to a high risk" within the meaning of the Regulation
2016/679, last revised and adopted on 4 October 2017, WP 248 rev. 01. 2 (6) pp. 15-
16 http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236
Page 26
The Data Inspectorate
DI-2019-7024
2 6 (31)
Article 35 of the subsystems concerned and has thus dealt with
personal data in violation of the current provision.
3. Choice of intervention
3.1 Possible intervention measures
The Data Inspectorate has a number of corrective powers available according to
Article 58 (2) (a) to (j) of the Data Protection Regulation, inter alia to impose it
personal data controllers to ensure that the processing takes place in accordance with
Regulation and, if necessary, in a specific way and within a specific period.
Of point (i) of Article 58 (2) and Article 83 (2) of the Data Protection Regulation
it appears that the Data Inspectorate has the authority to impose administrative
penalty fees in accordance with Article 83. Depending on the circumstances of
in the individual case, administrative penalty fees shall be imposed in addition to or in
instead of the other measures referred to in Article 58 (2).
Furthermore, Article 83 (2) sets out the factors to be taken into account when deciding whether:
administrative penalty fees shall be imposed and in determining
the size of the fee.
If it is a question of a minor violation, the Data Inspectorate receives according to what
set out in recital 148 of the Data Protection Regulation instead of imposing a
issue a reprimand in accordance with Article 58 (2) (b)
the Data Protection Regulation. Account must be taken of aggravating and mitigating
circumstances of the case, such as the nature of the infringement, the severity and
duration and previous breaches of relevance.
For authorities, according to Article 83 (7), national supplementary
provisions are introduced regarding administrative sanction fees. Of ch. 6 § 2
The Data Protection Act states that the supervisory authority may charge a penalty fee
by an authority in the event of infringements referred to in Article 83 (4), (5) and (6)
the Data Protection Regulation. In that case, Article 83 (1), (2) and (3) of the Regulation shall apply
apply.
Page 27
The Data Inspectorate
DI-2019-7024
2 7 (31)
3.2 Order
The Data Inspectorate has found that the Board of Education in the city of Stockholm,
by having a more extensive allocation of competencies than necessary in
the subsystem / module Compulsory school monitoring, has processed personal data in
contrary to Articles 5 (1) (f) and 32 (1) of the Data Protection Regulation.
Furthermore, it has been established that the Board of Education, although
impact assessments have been carried out continuously as new functionalities have
has not met the requirements for carrying out an impact assessment in
in accordance with Article 35 of the Data Protection Regulation.
The Board of Education in the City of Stockholm must therefore be instructed to ensure that
the processing in these parts takes place in accordance with the Data Protection Regulation according to
following.
The Data Inspectorate submits to the Board of Education, on the basis of Article 58 (2) (d)
in the Data Protection Regulation, to limit authorization allocations in the module
Compulsory school supervision for those people who have a need for treatment
the personal data to perform their tasks in the current module.
The Data Inspectorate also submits it to the Board of Education, with the support of an article
58.2 of the Data Protection Regulation, to implement one as soon as possible
impact assessment in the compulsory schooling subsystems,
The student documentation and the start page for guardians who meet
the requirements of Article 35 of the Data Protection Regulation.
3.3 A penalty fee shall be imposed
The Data Inspectorate has above assessed that the Board of Education in the relevant
subsystems have infringed Article 5 and Article 32 of the Data Protection Regulation.
These articles are covered by Article 83 (4) and 83 (5) respectively and in the event of an infringement
of these, the supervisory authority shall consider imposing administrative
penalty fee in addition to, or instead of, other corrective measures.
In view of the fact that they identified infringements in the subsystems
Compulsory schooling, Student documentation, Administration interface and
The home page has touched a very large number of registrants including children and
students, and included shortcomings in the handling of sensitive and privacy-sensitive
personal data, including data on persons with a protected identity,
information about health, grades, etc., it is not a question of a minor violation.
Page 28
The Data Inspectorate
DI-2019-7024
2 8 (31)
There is thus no reason to replace the sanction fee with a reprimand.
The Board of Education shall thus be subject to administrative penalty fees.
3.4 Determination of the amount of the penalty fee
General provisions
According to Article 83 (1) of the Data Protection Regulation, each supervisory authority shall:
ensure that the imposition of administrative penalty fees in each individual
cases are effective, proportionate and dissuasive.
For authorities, according to ch. § 2 second paragraph of the Data Protection Act that
the penalty fees shall be set at a maximum of SEK 5,000,000 at
infringements referred to in Article 83 (4) of the Data Protection Regulation and up to a maximum of 10
SEK 000 000 for infringements referred to in Article 83 (5) and 83 (6).
Violations of Article 5 are subject to the higher penalty fee under
Article 83 (5), while infringements of Articles 32 and 35 are covered by the lower
the maximum amount in accordance with Article 83 (4).
Article 83 (2) of the Data Protection Regulation sets out the factors to be taken into account in
determining the amount of the penalty fee. When assessing the size of
sanction fee shall, among other things. a. account is taken of Article 83 (2) (a) (nature of the infringement,
severity and duration), b (intent or negligence), g (categories of
personal data), h (how the violation came to the Data Inspectorate
knowledge) and k (another aggravating or mitigating factor for example
direct or indirect financial gain) in the Data Protection Regulation.
Assessment of mitigating and aggravating circumstances
In the Data Inspectorate's assessment of the penalty fee, account has been taken of the fact that
there have been infringements concerning several articles of the Data Protection Regulation,
whereby infringement of Article 5 is to be judged as more serious and covered by
the higher penalty fee. In order for penalty fees to be effective and
deterrence, a proportionality assessment must be made in each individual case.
A personal data controller must ensure before launching a new system
appropriate security. The requirements for the personal data controller and the measures that
taken to ensure adequate security must be set high when it comes to the issue
about a large number of data subjects and especially when it comes to data on
for example health and protected personal data, which means sensitive and
privacy-sensitive personal data processing takes place.
Page 29
The Data Inspectorate
DI-2019-7024
2 9 (31)
In the present case, special consideration has been given to the Board of Education in the City of Stockholm
has processed a large amount of personal data in the digital platform
used in the city of Stockholm, Skolplattformen, and that the violations have
concerned data on a very large number of data subjects, at least above
one hundred thousand registered. The current violations have included both
privacy-sensitive and sensitive personal data concerning children that are extra
worthy of protection. The violations have also meant that unauthorized persons have been able to obtain
access to data on persons with a protected identity. This is
personal data which by its nature has a high protection value as it can get a lot
serious consequences for the individual natural person if unauthorized sheep
part of the data.
Furthermore, the following aggravating and mitigating circumstances have been weighed into
the various subsystems that have been examined.
Compulsory school surveillance
Adverse circumstances in the module Compulsory schooling are the risks for
the lives of individuals caused by unauthorized access to
privacy-sensitive personal data concerning approximately 60 students with protected
identity. Another aggravating circumstance that the inspectorate has taken into account
is that the Board of Education has still not addressed the competencies in
module so that each user only has access to the data
he needs to perform his duties.
The student documentation
What have been aggravating circumstances regarding the shortcomings that have
found in the Student Documentation is that the technical shortcomings of this supervision
covers have enabled unauthorized access to sensitive and much
privacy-sensitive personal data concerning at least over one hundred thousand students.
All registered guardians have, by that in a relatively simple
manipulate the system, had the opportunity to access data such as
social security number, information about pupils who attend special school and pupils' grades and
reviews. The technical shortcomings in the Student Documentation have outside
the investigation in the case has existed for a period longer than six months and
was discovered by a guardian.
Page 30
The Data Inspectorate
DI-2019-7024
3 0 (31)
As an attenuating circumstance, the Education Board's actions have to
address the shortcomings after the discovery has been weighed in the assessment of
the size of the penalty fee.
Home page
The technical deficiency in the subsystem The start page has arisen in connection with
launch of a new functionality. That which has been aggravating
circumstances is that the defect was discovered by a guardian and not by
the Board of Education. This indicates that the Board of Education does not have
sufficient test seductions when launching new functionalities. As
mitigating circumstance, the inspectorate has taken into account the current
the shortage has existed for a short period and that the Board of Education
remedied the deficiency promptly after the discovery.
The administration interface
What has been aggravating regarding the shortcomings that have existed in the subsystem
The administration interface is that the shortcomings could have led to unauthorized persons
had access to data on approximately 50-60 employees with protected identities,
which can have very serious consequences for individuals.
Other aggravating circumstances that have been taken into account in the assessment of
the penalty fee is that the technical deficiencies have existed for a period
which exceeds one year and that the Board of Education as in November 2018
was made aware of the shortcomings of the Administration Interface,
did not take action until the deficiencies were rediscovered in August 2019.
Overall assessment of the size of the penalty fee
The Data Inspectorate decides on the basis of an overall assessment that
The Board of Education in the city of Stockholm must pay an administrative fee
a penalty fee of SEK 4,000,000 (four million) for those found
the violations in the subsystems Compulsory school surveillance, Student documentation,
The administration interface and the Home page for guardians.
This decision was made by Director General Lena Lindgren Schelin after
presentation by lawyers Salli Fanaei and Ranja Bunni. At the final
The case is also handled by the General Counsel Hans-Olof Lindblom, the head of the unit
Malin Blixt and the information security specialist Adolf Slama participated.
Page 31
The Data Inspectorate
DI-2019-7024
3 1 (31)
Lena Lindgren Schelin, 2020-11-23 (This is an electronic signature)
Appendix
How to pay penalty fee.
Copy for knowledge of:
The Data Protection Officer for the Board of Education in the City of Stockholm.
4. How to appeal
If you want to appeal the decision, you must write to the Data Inspectorate. Enter i
the letter which decision you are appealing and the change you are requesting.
The appeal must have been received by the Data Inspectorate no later than three weeks from
on the day the decision was announced. If the appeal has been received in due time
the Data Inspectorate forwards it to the Administrative Court in Stockholm
examination.
You can e-mail the appeal to the Data Inspectorate if it does not contain
any privacy-sensitive personal data or data that may be covered by
secrecy. The authority's contact information can be found on the first page of the decision.