AP (The Netherlands) - Uitvoeringsinstituut Werknemersverzekeringen (UWV)
|AP (The Netherlands) - n/a|
|Authority:||AP (The Netherlands)|
|Relevant Law:||Article 32 GDPR|
|Parties:||Uitvoeringsinstituut Werknemersverzekeringen (UWV)|
|National Case Number/Name:||n/a|
|European Case Law Identifier:||n/a|
|Original Source:||Autoriteit Persoonsgegevens (in NL)|
The Dutch DPA fined an administrative agency responsible for providing employment benefits €450,000 for failing to adequately secure personal data, including special categories of data, in messages that were erroneously sent to the wrong recipients on its website. Although the agency took certain organisational measures to secure user data, technical measures were only implemented after nine data security breaches affecting 15,000 individuals.
English Summary[edit | edit source]
Facts[edit | edit source]
The Employee Insurance Agency ('Uitvoeringsinstituut Werknemersverzekeringen', or 'UWV') is an independent administrative body, established under Article 2 of the Work and Income Implementation Structure Act (‘Wet structurur uitvoeringsorganisatie werk en inkomen’, ‘SUWI’). Individuals wishing to apply for employment benefits must register with the UWV as jobseekers. Every jobseeker has a personal environment on a section of the UWV website titled My Work Folder (‘Mijn Werkmap’).
Between August 2016 and the end of 2018, the sending of group messages in the ‘My Work Folder’ environment was not properly secured by UWV. As a result, files containing various personal data of job seekers ended up with the wrong recipients, namely in the My Work Folder environment of other job seekers. The personal data included: addresses, details about education, nationality, citizen service numbers, information about physical limitations, psychological and physical work ability, and whether people were too ill to work. The AP initiated an investigation after nine such data leaks had occurred at UWV, impacting more than 15,000 individuals.
Holding[edit | edit source]
The AP held that UWV had vailed to take appropriate technical and organizational measures to ensure a risk-appropriate level of protection for the processing of personal data in the My Work Folder environment, in violation of Articles 32(1) and (2) GDPR.
In particular, it considered that: the UWV had failed to sufficiently mapped out the risks involved in the processing personal data of jobseekers in advance; rather than taking organizational measures (for example, UWV had sent messages urging employees not to send attachments with group messages in the My Work Folder environment) the UWV should have implemented technical measures earlier (it was not until the end of 2018 that UWV took technical measures to prevent similar data leaks); and, the UWV insufficiently checked and evaluated its own security measures.
The AP emphasised that under Article 32(1) and (2) GDPR, the more ‘sensitive’ data are, the greater threat the data poses to individual privacy, and the greater the demand for security. Si nce the data leaked by UWV included special category health data, the consequences of a security incident relating to the personal data may be very serious for a wide group of individuals, and may relate to, for example, stigmatization or exclusion. The data leaked also included social security numbers, which can be used to link various data files on individuals and therefore pose a higher threat to privacy.
The UWV may still appeal the AP’s decision.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
AuthorityPersonal Data PO Box93374,2509AJ The HagueJ Bezuidenhoutseweg30,2594AV The Hague T0708888500-F0708888501 authority data.nl Confidential/Registered UWV Board of Directors Attn. Mr.M.R.P.M.Camps PO Box58285 1040HG AMSTERDAM Date Unidentified May 31, 2021 [CONFIDENTIAL] Contact [CONFIDENTIAL] Topic Decisiontoimposeafine Dear Camps, The Data Protection Authority (AP) has decided to join the Implementing Institute employee insurances (UWV) to impose an administrative fine of €450,000.UWV has insufficientarisk-adjustedsecuritylevelguaranteedandguaranteedwithin the framework of sending group messages via the MyWorkbook environment acted with article 13 of the Data Protection Act and article 32, first stone, second paragraph, of the General Data Protection Regulation. The AP explains the decision in more detail. Chapter 1 concerns an introduction chapter 2 contains the facts. TheAPassessesinchapter3oferrespectofprocessingpersonaldata,the controller of the violation. Chapter 4 discusses the (height of) administrative fine elaborated and chapter 5 contains the operative part and the remedies clause. 1Date Unidentified May 31, 2021 [CONFIDENTIAL] 1 Introduction 1.1Government body concerned This decision relates to the Employee Insurance Agency Implementing Institute (hereinafter: UWV). august2016 nine data leaks have occurred at UWV that were similar in nature data leaks all happened when sending a group message to a group of job seekers. In doing so, a wrong (Excel) file with a multitude of sensitive and special personal data of a varying number of job seekers sent with them, such as in the 'My Work Folder'- environment of job seekers. The number of job seekers whose data between 2016and 2018 were leaked, ran from 10 to 11,062 persons per data leak. Because in a period of two years, nine similar data leaks had occurred despite that UWV had indicated that it had taken measures, it was suspected that UWV did not have an appropriate technical and organizational measures (as required by law) to be appropriate to achieve a level of security that could prevent new similar data breaches. That is why the AP has started an official investigation. This decision covers the period from 2012 to enwith2018. 1.2Process flow On 4 September 2018, an AP supervisor contacted the op by telephone data protection officer (hereafter: DPO) of UWV.Supervisors of the AP then have requested information several times from UWV on which UWV has supplied this information. UWV also has Further documents sent to the AP on its own initiative. On 31 October 2019, your WV was asked to respond to the facts as known to the AP until then. On 14 and 18 November 2019, UWV responded to that request. By letter of 11 March 2021, the AP sent to YOURVWanintentiontoenforcement.AlsowiththisletterbytheAPinthe given the opportunity, the UWV on April 8 and 19 gave an opinion on this intention in writing and the underlying findings report. 2/41Date Unidentified May 31, 2021 [CONFIDENTIAL] 2.Facts 2.1TasksUWVandcommunicationwithjobseekers YOURVissetupon the basis of article2, first paragraph, of theLaw structure implementing organization works 1 2 income(SUWI).UWVis an independent administrative body with its own legal personality. Within UWV, the WORK company division is engaged in job placement and reintegration they map supply and demand through supply and demand. The WORK company focuses primarily on job searches with a great distance from the labor markets to employers who are willing to hire these job seekers. Persons who wish to apply for a benefit under the Unemployment Insurance Act must register with UWV register as a job seeker. 3 Werk.nlisawebsiteofUWV.Since 2007,everyjobseekerandopwerk.nlhaspersonal 4 environment that helps him/her in the job search: MyWorkbook. Ifajobseekerandone benefits, you can do this via My Work Folder among other changes, tasks and job application activities 5 pass on and exchange messages with attachments with UWV. UWV can use group messages if you send the same message to several job seekers must send. These UWV messages come in the My Workbook environment of job seekers justly. 2.2Source systemwith saved data jobseekers:Sonar Sonaristhe main source system that the WORK companies and municipalities use for job seekers 6 to work mediation by linking job seekers to vacancies at employers. The system contains data from the end of 2016 to 2018 on an average of 4,500,000 persons, including job seekers, the sick and incapacitated for work. 7 Sonar contains 630 data fields containing all kinds of data about people. Not for everyone 8 person, all data fields are filled in. The data in Sonar include NAW, education (level), nationality, social security number, data about physical limitations, psychological and physical work ability and whether people feel sick or are too sick to work. 1 2See, among other things, article 4 paragraph 1 SUWI and the ZBO register of the Dutch central government. See article 2 paragraph 2 SUWI and article 4 paragraph 1 SUWI and the zbo register of the Dutch central government. 3See article 26, paragraph 1, sub, dene, Unemployment Insurance Act. 4See, among other things, file document98 (Reply by UWV, file "Additional questions AP2110", p.1). 5See, among other things, file piece120 (Pageswebsitewerk.nl'Manual:Using Workbook'). 6See, among other things, file document6(PresentationProgrammeraadaboutUWVapplications,p.2,3,6and11). 7See file document38 (Excel file, answer to question6 in the case of data leak1) and file document98 (Reply by UWV, file "Additional questionsAP2110",p.1). 8 See file 38 (Excel file, answer to question 6 in the event of a data leak1) and file 81 (Reply by UWV, appendix 1 (file "AnswerquestionsAPAugust2019",answerquestion9)andattachment4(file"Question9-attachment")). 3/41Date Unidentified May 31, 2021 [CONFIDENTIAL] this data could be the state of mind or perception of the job seeker, who is herself an online has completed the questionnaire. 9 Sonar has about 15,000 users. Half of the total accounts are from WORK companiesbedrijf municipalitiesandotherhalfisofotherdivisionswithinUWV.Allusershavetheoption createandsavesearches.Usershavebasedonfunctionandassociatedtasks access to this data. 10 2.3Group Messaging On 16 July 2012, the management of the WERKbedrijf, after data leaks via e-mail, group messaging functionality in Sonar required for sending group messages to several job seekers at the same time. This decision was also decided together with the QuickReference Card “send group sonar mail to workbook” into the executive's attention to bring employees of UWV. AQuickReferenceCardisbyUWVwithintheWORKcompany used to record procedures and communicate the direction of UWV employees of these procedures. Certain actions are required to send a group message or an invitation to a selection via Sona 13 send job seekers. First of all, an employee of UWV selects a certain group personsinSonarrequeststypesofdataabouttheminSonar.Thentheemployeeexports fromUWVthissetwithdataofspecificpersonsfromSonarensavethewineexporteddata Then this data is converted into an Excel/csv file. There is no limit on the number persons whose data can be exported. In addition, the files are not protected, because according to UWV this would complicate implementation. Then this file is used as a base 15 to determine the recipients of the group message. The group message is sent after the UWV then to the recipients in the MyWorkbook environment.Thisprocessfordistribution ofagroupmessagedescribesUWValdusintheQuickReferenceCard“SonarSendgroupmessages from Sonar to the workbook” (hereinafter: QRC group messages). 16 9See file document38 (Excel file, answer to question 2 for data leaks 1 to 7) and file document 81 (Reply by UWV, appendix1 (file"Question AnswerAPAugust2019",answertoquestion3) and attachment2(file"Question3 Attachment")). 10 See, among other things, file document81 (Reply by UWV, appendix 1 (file "Answering questionsAPAugust 2019", answer to question 10)). 1See, among other things, file document98(Reply by UWV, file"Additional questionsAP2110",p.3andappendix6(file"29-12 action items listDT",p.3subpoint4)). 12See file document98(ReplybyUWV,file"Additional questionsAP2110",p.2andappendix4(file"28BV06Trailer banOutlookgroup messages0406212")andattachment5(file"28BV06Decisiondocumentforbidusegroupmailvia 13tlook")). See file document 66 (Reply by UWV, p.3). 14See file document38 (Excel file, under “Short description” with regard to all data leaks) and file document81 (Reply by UWV, attachment1(file"Answer questionsAPAugust2019",answer question11)). 15See file document81 (Reply by UWV, appendix 1 (file "Answering questionsAPAugust 2019", answer question11)). 16SeeDocument Document38(Excel File,Appendix29(File"MicrosoftWord97-1003Document"withexplanationforanswertoquestion13 with data leak6 and 7)), file document 91 (Reply by UWV, appendices 1 to 4). 4/41Date Unidentified May 31, 2021 [CONFIDENTIAL] According to YOURViser, when sending a group message, there is a limitation on the number of persons to 17 whom the message can be sent. Since mid-2013 to the present, this number is limited to 100 every prevent technical problems in Sonarte, thereby improving its performance and stability 18 messaging is smoother. All used versions of the QRC group messages state that if a UWV employee nevertheless wants to approach more than 100 people via the My Work Folder environment, this at the FunctionalManagementcanberequested.FunctionalManagementcanthemaximumverytemporarily increase to a larger number of persons. Furthermore, the QRC group messages state that attachments can be are sent along with group messages via Sonar, but it is preferable not to do so. 20 In the period from January 2016 to September 2018, according to YOURVintotal61,214 group messages sent via the My Workbook environment, with an average of 215 recipients personspergroup message. 21 2.4Data leaks related to the group messages In total, nine data leaks have occurred since the beginning of 2016 related to the personal 22 23 environment of job seekers: MyWorkbook. UWV has reported eight of these data leaks to the AP. Before January 1, 2016 there is no obligation to report data leaks to the AP. With these data leaks, when creating the group message, the Excel file with the export from . is always Sonar added. This resulted in this export file (instead of a message that had been sent should be like for example a vacancy text) in the MyWorkbook environment of job seekers rightly so.So itcouldnotseesecurethefilewiththeindividualdataaboutall recipients of the message will reach all intended recipients. 24 The AP has shown in the table below the most important facts about the data leaks. 25 17See file document81 (Reply by UWV, appendix 1 (file "Answering questionsAPAugust 2019", answer question11)). 18See file document 91 (Reply by UWV, appendices 1 to 4). 19See file document91 (Reply by UWV, appendices 1 to 4). 20See file document 91 (Reply by UWV, appendices 1 to 4). 21 See file document 86 (Reply by UWV, appendix 1 (file “numbers_messages_ap”)) and file document 91 (Reply by UWV,appendix5(file"numbers_messages_ap")). 22See, among other things, file documents8 to 12 and 15 to 21 (data leak (continued) notifications to AP) and file documents38 (Excel file, reply to question6mball data leaks). 23 The ninth data breach has not been reported to the AP, because UWV does not consider it likely that this is a risk to the rights and freedoms of persons. See, among other things, file document 81 (Reply by UWV, appendix 1 (file "Answering questions AP August 2019"), answer question8)) and file 83 (answer by UWV, answer question8). 24See also file document 45 (Reply by UWV, appendix “Decision memorandum FG research”, p.2). 25Source of this data: see file record8,9,10,11,12,15,16,17,18,19,20,21,38,51,81,86and98. 5/41Date Unidentified May 31, 2021 [CONFIDENTIAL] Date data breach Number Number Type data stakeholders involved who whose message het datahaveopened leaked Surname, Citizen Service Number (BSN), last occupation, 1 22-8-2016 195 14 education level and row ID 2 14-9-2016 151 20 Surname, place of residence, date of birth, social security number, first WW day, date on which WW expired of some whether they are sick or at work, that they not being reachable by text message or not being digitally skilled 3 15-9-2016 135 26 BSN 4 22-9-2016 11062 26 Surname, zip code, city, e-mail address, BSN, age, gender, profession (sector), education (level), first unemployment benefit day and date when WW ends, or status of cvactive or expiration, number of daysWW on which job seekerhas right, row ID 5 21-2-2017 189 10 BSN, initials, surname, gender, e-mail email address, age, WERKbedrijf location, first WW day, total score on the online questionnaires a brief description of barriers to regarding finding work (such as psychologically or physical work ability), including for 73 data subjects health data. This one health data do not concern a disease or medical reports, but, for example, whether someone is too sick to work. The first WW- day it can be deduced that all 189 involved receive unemployment benefits (not the amount de thereof). 6 26-3-2018 10 7 Name, zip code, place of residence, education (level) and social security number 7 28-3-2018 90 12 Surname, zip code, place of residence, professional sector and BSN 6/41Date Unidentified May 31, 2021 [CONFIDENTIAL] 8 3-8-2018 2503 70 Surname, gender, date of birth, social security number, telephone number, level of education, last occupation, last employer, categories driver's license, oral and written skills Dutch, first, second and third professional sector, registration/mediation profession, available hours per week, hours still working, first WW day, maximum last day WW- benefit, age group based on first unemployment benefit day, indication, whether there is an exemption and the ID. 9 5/9/2018 996 9 Last name enrow ID 2.5 Policy within UWV WithinUWV, in any case 2016, policy was drawn up to address risks in the processing of to detect and deal with personal data early on the basis of a careful risk assessment, where risks are neutralized or explicitly accepted by a director UWV to register the (outcomes of) risk assessments based on the policy. 26 Also, within YOUR VIN, at least from 2016 to 2020, a policy had been drawn up for technical and implement organizational security measures in a risk-driven manner and setzet check, evaluate and adapt. 27 2.6PracticewithinUWV 2.6.1Weighing the risks in practice The AP has asked UWV several times whether and if so what risk analyzes have been carried out in order to 28 protect personal data when sending group messages. HowandwhichrisksUWV has weighed precisely, partly in response to the data leaks that have occurred, to determine whether personal data when sending group messages via the My Work Folder environment sufficient than UWV did not mention being sufficiently secured. 29 YOURV turns out not to be clear in its answers, even sometimes to give a contradictory image about it (periodically) performing risk analyzes with regard to the security of personal data at the sending group messages via the My Work Folder environment. UWV has stated in any case that it 26See appendix 1 page 25 for the exact parts from the policy documents of the UWV. 2See appendix 1 page 25 for the exact parts from the policy documents of the UWV. 28See, among other things, file document27 (Letter to UWV, p.4-5) and file document69 (Letter to UWV, question 12) and file document 93 (E-mail to UWV). 29See, among other things, file document38 (Excel file, reply to 11 under data leak1 to 4) and file document81 (Reply by UWV, appendix1 (file"Answering questionsAPAugust2019",answertoquestion12)) and file 98(answer by UWV, file "Additional questionsAP2110",p.2). 7/41Date Unidentified May 31, 2021 [CONFIDENTIAL] did not perform a risk analysis prior to the 2012 decision to go into group messaging send via the My Work Folder environment. UWV has stated several times that from 2016 to and with the latest data leak in 2018 in the context of data security during transmission ofgroupmessagesthroughtheMyWorkbookenvironmenthasperformedrisk assessments answersfromYOURVandsubmissionsisnotshowedhowtheseriskconsiderationsare made and which risks have been weighed up at any open moment in that period. UWV has also risks not regularly weighed up. 30 2.6.2Measures, checks and adjustments in practice YOURSendofdataleaknotificationstotheAPofthesecondandthirddataleaktheyareinvestigating 31 was whether technical measures are possible to prevent these data leaks. Inthenotificationofthe fourth data leak at the AP gave YOU to investigate whether it was possible to place “such” 32 files” in the MyWorkbook environment. UWsetsenddataleaknotificationstotheAP of the third and fourth dates leaked at the end of September 2016 that the employee who made the mistake this was addressed by management and that awareness was being looked into. 33 After the first four data leaks in 2016, UWV decided to take organizational measures. 34 On 28 September 2016, UW first decided to take temporary organizational measures. And however UWV has stated that these temporary measures still apply, as a result of a decision of the District manager consultation (DMO) of UWV that the temporary measures to be taken on 28 September 2016 it was decided, in October 2016, to be replaced by other organizational measures AP established that UWV has drawn up the “Guideline for safe communication at WORK company” and that it intend not to investigate the possibilities of taking technical measures by YOURViscarried out.In addition,theAPconcludedthattherecommended after October 20th 2016 organizational measure(s) prior to the fifth data leak has not been checked nor evaluated by UWV. 35 UWV subsequently decided after the fifth data breach (February 21, 2017) to further organizational measures with regard to the sending of group messages via the My Workbook environment, namely by increasing awareness in doing so. UWV did that through workshops and a few visits to districts.UWVthendecidednottotaketechnicalmeasures.Otherwise,thereafter20 october2016theorganizationalmeasure(s)inforcewith regardtothesendingof group messages via the My Work Folder environment also not before the sixth data breach by UWV 36 neither checked nor evaluated. The statement of UWV that these measures have been checked and evaluated, UWV has not substantiated with documentation. 30See appendix1, page 26 and 27 for the exact answers of the UWV. 3See file documents9 and 10 (Data breach notifications). 32See file documents11 and 12 (Data breach (continued) notifications). 3See File Document 10 (Data Breach Report) and File Documents 11 and 12 (Data Breach (Continued) Reports). 34 35See appendix 1 page 28 and 29 for the exact measures of the UWV. See appendix 1, pages 30 to 34 for the exact measures and statements of the UWV. 36See appendix 1, pages 33 to 35 for the exact measures and statements of the UWV. 8/41Date Unidentified May 31, 2021 [CONFIDENTIAL] After the seventh data breach (March 28, 2018), UWV decided on several organizational measures. However, your WORK company have not checked as such whether these measures are actually have been introduced. Apart from two measures, YOURVook has no documents or a further substantiation provided on the basis of which it can be established or the organizational measures are secured in documentation and when they are implemented. After the eighth data leak(3August 2018), UWVdecidedtointroduceatechnical measure, which is to block the possibility of adding, among other things, Excel fileswhensendinggroupmessagesviatheMyWorkbookenvironmentfordataleakageinthere This technical measure was implemented in December 2018, so far after the ninth data breach, by UWV implemented. The abovementioned facts cover the period from 2012 to 2018. This concludes the investigation of the AP only relates to this period. In its view, UWV still has the following declared over the period after 2018. UWV has stated that in the process for sending group messages in the My Work Folder- environment next to the technical measure, which has the specific risk of sending Excel lists removed, also actively used to raise extra awareness among (new) employees in the implementation who have frequent (digital) contact with job seekers for the performance of their tasks are nowwithin WORKcompanytheprocessdescriptionsandQuickReferenceCards(QRCs)annually evaluated and adjusted if necessary. Furthermore, at the end of 2018, the FG carried out a study on behalf of the Board of Directors of UWW following the eighth data, a report of findings appeared to be prepared. Specifictothe mitigating the risks of sending group messages in the MyWorkbook environment, it DPO investigationthatthetechnicalmeasurethatuploadsExcelfilestotheMyWorkbook- environment, is an effective measure to prevent this type of data leakage. Partly as a result of the FG investigation, UWVWERK company has continued to be assigned to KPMG given to conduct a broader investigation into the source system SONAR. This to determine value vulnerabilities and risks are located in a technical, process as well as organizational area, in which the already existing organizational and technical measures have also been evaluated (check- phase). In 2020, this research resulted in four advisory reports with 77 recommendations 39 advisory report privacy is largely disclosed by UWV. As a result of the advisory reports, the large-scale improvement project SONARIB&P was started in 2020, which aims to address the findings of the survey and the SONAR IB&P risk level reduce strength (act->plan->do-phases).UWVwillbeanextratechnicalmeasure 3See appendix 1, pages 35 to 41 for the exact measures and statements of the UWV. 3The 'Step-by-step plan Sharing Safe Personal Data'whatUWVcommunicatedtoemployees on May 1,2018.Tevenshad UWVexpandedtheQRCgroupmessageswiththepassageaboutcleaning(Excel)filesandthe4-eyesprinciple. 3See https://www.uwv.nl/overuwv/Images/bijlage-1-bij-besluit-wob- Request-research report-sonar-privacy.pdf. 9/41Date Unidentified May 31, 2021 [CONFIDENTIAL] implement the export functionality from SONAR for employees in the implementation, except for someenkel authorized employees will be closed. Seeing the recommendations from the KPMG research according to YOUR V Also to improve the risk management process, including the Plan-Do-Check-Act cycle (hereinafter: PDCA cycle). this improvement in risk management and the implementation of control measures will WORKcompanythegrowthinimplementingthePDCAcycle–and therebyensuring that appropriate technical and organizational measures have been taken and are being continued. 3.Legal Review 3.1Processing of personal data As of May 25, 2018, the General Data Protection Regulation (GDPR) will apply. Given the facts in this investigation took place between 2012 and 2018, the AP will both personal data (Wbp) as the AVG keys. The concept of personal data is defined in article 1, sub, of the Wb and article 4, part 1, of the AVG.Inarticle 16 of the Wbp, data about health are considered special personal datamarked.TheGDPRmarkedinarticle9dataabouthealthas well as special data. Personal data within the meaning of the Wb and AVG are all information about an identified or identifiable natural person.Sonar contains data about natural persons such as names, addresses, the SSN and other information. This information allows the Sonar registered natural persons, among which job seekers are identified directly or indirectly.Sonar contains so personal data within the meaning of article 1, under a, of the Wb and article 4, part 1, of the AVG. Sonar also includes data on physical limitations and the mental and physical workabilityofpersons.Also statesinSonarofpersonsfeelingsicktowork.On under article 16 of the Wb and article 4, part 15, of the AVG, this is data about the health. From the above it follows that UWVwhen sending group messages via the MyWorkbook environment personal data, including the BSN and health data, processed within the meaning of the Wbpen the AVG. 4 On that date, pursuant to article 51 of the UAVG, the Personal Data Protection Act (Wbp) was withdrawn. 10/41Date Unidentified May 31, 2021 [CONFIDENTIAL] 3.2 Controller The term (controller) is defined in article 1, sub, of the Wb and article 4, part 7, of the AVG. In the case of independent administrative bodies at state level, the body charged with the duties and exercise of powers for which the data is processed, as a controller are notable. As stated in section 2.1, YOUR V is set under a law, namely the SUWI. U W V is a independent administrative body of the central government with its own legal personality. As above in the case of independent administrative bodies at state level, is the body charged with the tasks and exercise of powers for which the data is being processed, as responsible.UWVW has both legal and de facto control over the processing of data that are collected within the scope of group messaging through the workbook. Based on the above, the APUW marks Vaan as (controller) responsible as referred to in article 1, part, of the Wb and article 4, part 7, of the AVG for the processing of personal data in the context of sending group messages via the workbook. 3.3Securityofdataprocessing 3.3.1Legal framework From September 1, 2001 to May 25, 2018, the security of the processing of personal data, article 13 of the Wbp. The security obligation extends to all parts of the process of data processing. The term «appropriate» implies that the security in in accordance with the state of the art. This is firstly to no demand from professional ethics of persons in charge of information security. The standards of the sea ethics are applied in this provision of a legal capstone, in the sense that there is a legal obligation for the the responsible person is connected. The term «suitable» also indicates a proportionality between the security measures and the nature of the data to protect. For example, as the data have a more sensitive character, or the context in which they are used a greater threat to the privacy, strict requirements are placed on data security. The European Directive on the basis of which, among other things, Article 13 of the Wbp has been drafted under otherwith regard tothesecurityoftheprocessingofpersonaldata:“thatthe principles of protection (…) must be reflected in the obligations imposed on persons, public authorities, undertakings or other bodies that carry out the processing are imposed, and obligations that in particular relate to the quality of the data, the technical security, the registration with the supervisory authorities and the circumstances in which the processing may be carried out (…)”. It also includes with regard to the security of the processing of data: “that the protection of the rights and freedoms of data subjects in connection with the processing of personal data, both in design and in 41 See Directive 95/46/EC of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and with regard to the free movement of such data, recital 25. Underline of the AP. 11/41Date Unidentified May 31, 2021 [CONFIDENTIAL] in the execution of the processing requires appropriate technical measures, in particular to ensure safety guarantee and thus prevent any unauthorized processing;(…)”. 42 The Dutch DPA has in a case that concerned access to electronic medical records - with respect to of the taking of security measures in the context of article 13 of the Wbp is judged as follows: “A responsible person may only proceed to take purely organizational measures if he can demonstrate that it is not possible to take appropriate technical measures. This must be compensated for with additional 43 organizational measures and monitoring compliance with them”. In order to implement article 13 of the Wbp, the Dutch DPA has in 2013 guidelines with regard to security of the processing of personal data (hereinafter: Dutch DPA guidelines). When drafting the CBP guidelines have been sought to join the ISO27001. The guidelines set as necessary preconditions to ensure a continuous appropriate security level of processing of to obtain and guarantee personal data as required by law: “take measures based on risk analysis, security standards and applying and embedding in a plan-do-check-act cycle”. The CBP guidelines state about this PDCA cycle: ''After establishing the reliability requirements, the responsible measures with which he ensures that the reliability requirements are met. Then The person responsible checks whether the measures have actually been taken and have the desired effect. The total reliability requirements, measures and control are regularly evaluated and adjusted where necessary, so that a permanently appropriate level of security is achieved”.5 Like ISO27001, the CBP guidelines (as part of the PDCA cycle) also write before the controller takessecurity measures based on a risk analysis, whereby he identifies threats that could lead to a security incident, the consequences it securityincidentmayhaveandthechancethatthesuccessfollowsoccur.Wheninventoryand assessing the risks are relevant mainly to the consequences that those involved may experience from unlawful processing of their personal data. Depending on the nature of, these consequences may the processing and processing of the processed data, including stigmatization or 46 exclusion, harm to health or exposure to (identity) fraud. In the GDPR, Article 32 contains the requirements concerning the security of the processing of personal data The risk should be taken into account when determining appropriate measures privileges and freedoms of persons. 47 Recital 83oftheGDPRstatesaboutensuringthesecurityofprocessing personal data and assessment of the risks: “In order to ensure security and to prevent the 42See Directive 95/46/EC, Recital 46. Underlining the AP. 43See, among other things, caseZ2003-0145,p.3. 44 45See CBP Guidelines: Security of Personal Data, https://wetten.overheid.nl/BWBR0033572/2013-03-01. See CBP Guidelines: Security of Personal Data, https://wetten.overheid.nl/BWBR0033572/2013-03-01. 46See CBP Guidelines: Security of Personal Data, https://wetten.overheid.nl/BWBR0033572/2013-03-01. 47See also recital 75 of the GDPR. 12/41Date Unidentified May 31, 2021 [CONFIDENTIAL] processing infringes this Regulation, the controller or the processor shall processing to assess the inherent risks and take measures, such as encryption, to mitigate those risks. measures to ensure an appropriate level of security, including confidentiality, account taking into account the state of the techniques, the execution costs, the risks and the nature of the protection to be protected personal data. When assessing data security risks, attention should be paid to risks that occur in data processing, such as the destruction, loss, modification, unauthorized provision of or unauthorized access to the data transmitted, stored or otherwise processed, either by accident it is illegal, which in particular can lead to physical, material or immaterial damage.” Finally, in 2007 the Decree on information security government service (hereinafter: VIR) is in force become. In 2014, the Administrative Statement Information Security, UWV declares to go to the VIR 49 handle. With regard to the concepts used in the VIR, it is stated: “The concept framework of the Information Security Code (ISO17799:2005) is adopted in this regulation”. The PDCA cycle off 51 ISO17799:2005 has since been incorporated into ISO27001. This standard contains a number of steps that must be performed. The steps form a so-called Plan-Do-Check-Act cycle (hereafter: PDCA cycle) to respond to (ever-changing) threats in relation to the information. 52 Article 4 VIR identifies the responsibilities of line management notes to the VIRis about article 4 VIR includes the following: “Created deliberately to article 4 in to formulate terms of the Planning and Control cycle, in accordance with regular business operations. (…) Information security itself 53 takes place via the Deming quality circle (PDCA cycle)”. In the article-by-article explanation of the VIR is in addition, with regard to article 4: “For the effectuation of information security, we work through the PlanDo CheckActcycle(...).Afterdeterminingwhatisneeded(reliabilityrequirements),measuresaretaken checked whether these measures have the desired effect (control). This control can directly lead to adjustment in the measures. Also, the total of requirements, measures and control can be subject to revision (evaluation). 54 go through this quality circle and ensure the adequate level of security at all times”. 3.3.2Assessment From both article 13 of the Wb and article 32, first and second paragraph, of the GDPR it follows that the controller must take appropriate technical and organizational measures to security level of the processing of personal data appropriate to the risk guarantee/guarantee. These provisions are intended to guarantee the same (legal) interests and there is no (substantial) material change of the regulations on this point. To ensure a risk-adjusted level of security in the processing of personal data guarantee/guarantee, a controller should therefore analyze risk, appropriate 48Government Gazette28 June 2007, no.122. https://zoek.officielebekendmakingen.nl/stcrt-2007-122-p11-SC81084.html. 49Government Gazette2014,15447,https://zoek.officielebekendmakingen.nl/stcrt-2014-15447.html. 50Government Gazette28 June 2007, no.122, p.12. 51ISO/IEC27001:2013chapters6t/m10. 52 53See, among others, ISO/IEC27001:2013,Chapters 6 to 10 and ISO/IEC27001:2017. Government Gazette28june2007, no.122,p.12. 54Government Gazette28 June 2007, no.122, p.15-16. 13/41Date Unidentified May 31, 2021 [CONFIDENTIAL] take measures and evaluate the move. These steps form the preconditions for a continuous ensure an appropriate level of security for the processing of personal data in line with the law, namely by embedding in a plan-do-check-act cycle (PDCA cycle). This cycle is in line with the procedure mentioned in article 32, first paragraph, of the GDPR, namely a procedure for periodically test, assess and evaluate the effectiveness of the technical and organizational measures to protect the processing. Also the VIR, where your WV is located has conformed, is based on ISO 27001 and writes a PDCA cycle. This general accepted security standard takes into account the AP in this case. The AP works the different steps of the PDCA cycle below. Weighing the risks for persons before determining measures Thestartingpointthatisperformedunderthesecureoftheprocessingof personal data is a weighing up of the risks of that processing. Based on this, it is determined what measures are necessary to counter these risks. It follows from the WB and the AVG explanation that when considering data security risks attention should be paid to risks that arise in the processing of personal data. Such as unauthorized disclosure of or unauthorized access to processed data and assessing the risks are relevant mainly to the consequences that persons may experience from a unlawful processing of personal data. The more sensitive the data is, or the context in which they are used a greater threat to privacypersoonlijk mean, stricter requirements are placed on the security of personal data. When sending group messages via the MyWorkbook environment, as stated in section 2.4, there have been several (accidental) unauthorized disclosures or unauthorized disclosures access of processed personal data of job seekers. UWV is therefore expected that they, to arrive at a security level appropriate to the risks, continuously inventory and assessesthatmayleadtoasecurityincident.UWVexistedfromatleast2016 policy to detect and tackle risks in the processing of data early on the basis of a careful risk assessment. The VIR also obliges UWV to carry out an explicit risk assessment determining appropriate security measures. As concluded in section 3.1 the AP, YOUR Vin Sonar processes a multitude of different personal data of a highly sensitive nature, including data about the health of persons andthe BSN.UWVprocessedat the end of the period from 2016 to 2018, data on an average of 4,500,000 persons. Jobseekers, the sick and incapacitated for work and who are legally obliged to register with UWMust provide therefor their personal data,must be able to rely on UWV properly weighs the risks that these persons run security incident with regard to the data that UWV processes may be serious for a large group of persons. Thus, it may not sufficiently secure the processing of these personal data lead to stigmatization or exclusion. Now UWVookthe BSNprocessingwhatinthe 14/41Date Unidentified May 31, 2021 [CONFIDENTIAL] practicesignificantly facilitateslinkingofdifferentfiles,moreexistingforpersons whose data in Sonar represents an additional risk of a threat to privacy. The policy of UWV contains measures, including an explicit risk assessment as part of a PDCA cycle. Contrary to this policy, it appears that UWVin their answers regarding the sendinggroupmessagesviatheMyWorkbookenvironmentprovidesacontroversialimageaboutthe performing such risk assessments with regard to the security of personal data. UWV has in any case stated that prior to the decision in 2012 to only send group messages sendviatheMyWorkbookenvironmentnoriskanalysishasbeenperformed.UWV thenasked thatfrom2016tothelastdataleakin2018underthesecurityof personal data when sending group messages via the My Work Folder environment has carried out risk assessments showed how UWV has made these risk assessments and what risks are involved at any time in that period have been weighed up and how they have considered the possible consequences for job seekers insofar as UWV is of the opinion that the proposed measures of October 2016 do represent a risk assessment contains, the AP notes that there is a balancing of risks in the sense of the (explanation of the) law It only contains a proposal for measures without further substantiation. It also shows this document does not indicate that risks to persons have been taken into account when proposing measures. Stronger yet, UWV only talks about risks that YOURV itself runs in its customer communication. organization such as UWV, which processes so many particularly sensitive data of so many people, and the consequences for them when sending group messages via the Myworkbook environment can be far-reaching, it does not or does not take sufficient account of the risks for job seekers extra careless when determining security measures. Based on the above, the AP concludes that UWV with regard to the impact of security measuresin the context of sending group messages via the MyWorkbook- environment the risks for job seekers, who, in view of the sensitivity of the data that UWV processes can be drastic, in any case in the period from 2012 to 2018 not/insufficiently mapped with this.UWVinsufficientlyhas a risk-adjusted level of security guaranteedandguaranteed. Taking technical and organizational measures Aftermappingandweighingtherisksforpersonsofdataprocessing the determined measures should then be implemented and carried out. Both article 13of the Wbp as article 32, first paragraph, of the GDPR, obliges the controller to the takingtechnicalandorganizationalmeasurestoprotecttheprocessingof to safeguard personal data. Paragraph 2.6 shows that UWV only has organizational measures until December 2018 implemented in the context of sending group messages via the My Workbook environment to theom to ensure the security of the processing of personal data. An example of a 55 See appendix1page30. 15/41Date Unidentified May 31, 2021 [CONFIDENTIAL] organizational measureisthemessagewhereemployeesarecalledpreferablyno Sending attachmentswithgroupmessagingthroughSonar.Themeasuresregardingarestrictiononthe number of job seekers to whom the message can be sent further, as YOURVook puts it, to avoid technical problems in Sonart that would improve its operation and stability themessaging traffic is smoother.Thisisnotforthesecurityoftheprocessingof personal data. This limitation only applies to the number of recipients of a message, but does not limit the number of job seekers whose data can be obtained by UVW In addition, the limitation to 100 recipients could be bypassed by a request to do so to dowithFunctionalManagement.Fiveoftheninedataleaksisthesamegroupmessagetomore than 100 job seekers sent simultaneously via the My Work Folder environment. UWV had decided on 20 October 2016 (after the fourth data breach) to conduct an investigation in the short term start to the possibility of taking technical measures, including the technical make it impossible to add Excel files to a workbook message.It then has until after the eighth date in September 2018 lasted before UWV subsequently decided to take a technical measure, namely blocking the possibility of adding, among others Excel files when sending group messages via the Myworkbook environment.However, it turns out UWV only in December 2018 (before the ninth date on September 5, 2018 and after the 2016 announced investigation into the introduction of technical measures) has proceeded to the three months earlier decision to actually carry out. Taking this technical measure is therefore possible. The data leaks do not seem urgent for UWV to initiate the research suggested in 2016U to the possibility of carrying out technical measures soon. By not (also) implementingatechnicalmeasurehasyourVinadequatelyadaptedtoarisk securitylevelguaranteedtherebyacceptedariskofdata leaks for more than two years with a lot of data concerning a large group of citizens. Checkingandadaptingmeasures Technical and organizational security measures should be based on both the Wb and the AVG to ensure a level of security appropriate to the risk.This is necessary in any case to check whether the measures have been implemented, correctly applied or carried out and what theeffectofthemeasuresisontheinitiallyidentifiedrisks.Basedonthischeckofthe measures are then determined whether the measures are still appropriately tailored to the risk security level or whether additional measures are required. WithinUWVmoneyfrominanycase2016to2020policytotakemeasures check and, if necessary, adjust as part of a PDCA cycle UWV does not have a generic policy in which it checks whether UWV central measures are in place implemented in practice by the responsible division(s) and that regional offices to some degree can give your own interpretation to central policy.UWV also reports about this that no formally protocolled procedure is within UWV, within which is 16/41Date Unidentified May 31, 2021 [CONFIDENTIAL] checked whether such agreed organizational and process measures are takenword implemented, because that would be impractical given the size of the organization and quantity decisions that UWV takes. YOU also indicate that it has not checked or measures decided upon as a result of data leaks have actually been introduced. UWV has also entered into force after 20 October 2016 being the organizational measure(s) prior to the fifth (2017) and sixth (2018) data breach checkednorevaluated.Finally,UWVhasnotshownthatithasopenmoment checked whether the organizational measures that were in place prior to the eighth data breach (2018) have been introduced.UWV has also not evaluated these organizational measures. As previously concluded, the consequences for job seekers are insufficiently secured sending of group messages through the workbook. Especially at an organization like UWV, which is so much sensitive and special personal data of so many persons are processed, it is necessary to check whether measures are actually (correctly) implemented evaluate the move and adjust it where necessary fit.JobseekersandotherswhoarelegallyobligatedregisterwithUWVTherefor must provide their data, must be able to rely on UWV measures checks, evaluates and adjusts if necessary. Based on the above, the AP concludes that UWV has implemented the security measures in the framework of the sending of group messages via the My Workbook environment does not have/insufficiently auditedandevaluated,makingUWVinadequatearisk-adjustedsecuritylevel hasguaranteedandguaranteed. 3.4Opinion of UWVenreactionAP In this paragraph, the AP briefly summarizes your view of UWV with the response of the AP. YOURV notice first stop that it regrets that it has not been sufficiently fulfilled different phases of the PDCA cycle. UW strongly supports the findings of the AP to improve this process. 3.4.1View on factual findings YOURFISH believes that the analysis of the eighth data leak shows that the eighth data appeared to be directly affected measures have been analyzed as well as evaluated by UWV, whereby measures are also proposed. The AP notes about this that UWV has indeed analyzed and evaluated the eighth data, but this analysis does not show that UWV is processing personal data in the context of sending ofgroupmessagesthroughtheMyWorkbookenvironmenthasevaluatedonitself.Theevaluationofa loosedata leakinsufficient fulfillment of a risk-adjusted security level with associated PDCA cycle. In addition, it cannot be deduced from the analysis that UWV has taken immediate action. The introduction of the technical measure has been discussed by UWV, but this measure has only been 17/41Date Unidentified May 31, 2021 [CONFIDENTIAL] introduced later. In addition, the AP considers it to evaluate measures that should have been introduced useless. YOURFleshnotbackinthefindingsthatitindicatedAugust2019thattheWORKcompanyanexternal would conduct research into the export functionality from Sonars to the sending of group messages via the work folder. The AP did not take your plan to have an external investigation carried out as a fact because this was only an intention of UWV yet. In addition, this intention does not refer to the period of the established violation. However, the AP did mention this investigation in paragraph 2.6 of the present decision. 3.4.2Viewpointonlegalframeworkandassessment The norm that a responsible person may only proceed to take purely organizational measures if he can demonstratethatitisnotpossibletotakeappropriatetechnicalmeasures,according toUWVissufficientlyfollowedfromthe CBP- 2013 security guidelines, a CBP case and the other sources cited in the report. The AP does not follow this view of UWV. First, the AP did not refer only to a CBP case, but also to the Directive 95/46/EC of 24 October 1995 on the protection of natural persons in connection with the processing of personal data and with regard to the free movement of those data, considerations 25 and 46. Secondly, both article 13 of the Wbp and article 32 of the AVG that the controller must take appropriate technical and organizational measures. Technical and organizational measures must be taken cumulatively. The standard in article 13 oftheWbpenarticle32oftheAVGisconsistentlyclear, according to theAP.UWVhasnomore argued that it was allowed to limit its impact solely by organizational measures, since it was not possible to take appropriate technical measures would also have been untenable, now that YOU will find in December 2018 just in the end and technical measure has been implemented. It is possible that not all measures were equally effective and may have been misjudged the conclusion cannot be drawn from YOURV that the implementation of appropriate measures. And from the single data that has been sitting for some time between the evaluation moments and the According to the UWV, on the basis of the findings, the introduction of the technical measure cannot be concluded that from the eighth date there has been no or insufficient completion of the implementation of appropriate measures, if as a result of insufficient risk management. The AP does not follow this view of UWV and motivates this as follows. The AP has assessed the whole whether UWV has a security level appropriate to the risk for the processing concerned guaranteedandguaranteed.ThatUWVhastakensomeorganizationalmeasuresdoesn't matter the determination that UWV has insufficient risk analyses, technical measures and checks As a result, as stated by YOUR Vook itself, the security measures are not effective 56 https://www.autoriteitpersoonsgegevens.nl/nl/nieuws/arbodienst-handelt-niet-slagen-met-wbp-%C2%A0 18/41Date Unidentified May 31, 2021 [CONFIDENTIAL] In addition, UWV did not come up with the recommendation until after the eighth data breach (August 3, 2018) to take technical measures, while in October 2016 it was already decided in the District Manager consultation that in the short term, the possibility of technical possibilities had to be explored In the intervening period of almost 2 years, UWVal thus failed to conduct this research. YOU further believe that an evaluation has taken place after the eighth date of the leak. above, UWV does not follow the duration of the detected violation. According to UWV, after the eighth data leakage is applied to an appropriate level of security. TheAPisevaluatedwithUWandthattheeighthdataleakhasbeenevaluated.However,thisevaluationcontainsonlyone data breach. The AP would like to emphasize again that UWV the measures taken are not in periodic has fully evaluated and has not sufficiently analyzed the risks in advance moreover, the investigation only took place from November 2018 and the technical measure was by UWVin introduced in december 2018. The AP therefore also does not follow the view that UWV from the eighth data breach (August 3, 2018)guaranteedandguaranteedarisk-adaptedsecuritylevel. In hindsight, with today's knowledge, according to UWV, the process has not been followed sufficiently and is insufficient documented.UWV notes here that the findings do not show that they have not been filled in at all at the different phases of the PDCA cycle or during the entire period from 2012 to the end of 2018. The AP agrees that the findings do not indicate that the different phases of the PDCA cycle, but notes that this has not been sufficiently specified. It appears from what YOUR Vwel has documented that only the jamming was taken into account of the systems of UWV where the risks for those involved were not mentioned. UWV has furthermore some organizational measures taken, but not the necessary (and technical) measures resulting in an insufficient level of security. 3.5 Conclusion The AP concludes that UWVinsufficientlyasecurityleveladjustedtotherisk guaranteed and guaranteed in the context of sending group messages via the My Workbook environment. As a result, there was a continuing violation where YOUFIND period from 2012 to May 24, 2018 has acted contrary to article 13 of the Wbp from 25 May 2018 to December 2018 has acted contrary to article 32, first stone, second paragraph, of the AVG. 19/41Date Unidentified May 31, 2021 [CONFIDENTIAL] 4.Penance 4.1 Introduction UWV has acted in conflict with article 13 of the Wb and article 32, first stone and second paragraph, of the AVG. For the established violation, the AP uses its power to fine your layfortheperiodfrom1january2016(startpenaltyauthorityAP)untilDecember2018.Consideringseverity of the violation and the extent to which it can be blamed on UWV, the AP considers the imposition of a fine. The AP motivates this in the following. Considering that in this case, there is a continuing violation that is subject to both the Wbp and the GDPR occurred, the AP has checked against the substantive law as it applied at the time when the behavior took place. In this case, both article 13 of the Wb and article 32, first stone, second paragraph, of the AVG. These provisions are intended to guarantee the same legal interests and there is no (material) material change of the regulations on this point. Given that the gravity of the infringement is at the time of the Wbp, the AP sees reason in this case to join the 'Penance policy rules' Dutch Data Protection Authority2016'. 4.2 Fine policy rules of the Dutch Data Protection Authority 2016 In this case, DeAPusesthe‘Finance Policy RulesAuthority of Personal Data2016’ (Fine Policy Rules) for the fulfillment of the power to impose an administrative fine, including determining 57 from the height of it. In the Fine policy rules, a category formats bandwidth has been chosen systematically. Violationofarticle13oftheWbpisingpartincategoryII.CategoryIIhasafinebandwidth between €120,000 and €500,000. Within the bandwidth, the AP sets a basic fine. As a starting point applies that the AP sets the basic fine at 33% of the bandwidth of the violation linked to fine category. In this case, the basic fine is set at €245,400. 4.3 Fine amount The amount of the fine adjusts the AP to the factors mentioned in article 6 of the Fine policy rules, by decreasing or increasing the base amount. It is about an assessment of the seriousness of the violation in the specific case, the extent to which the violation may affect the offender be blamed and, if there is reason to do so, other circumstances such as the (financial) circumstances in which the offender finds himself. 5Policies of the Data Authority of December 15, 2015, as last amended on July 6, 2016, with regard to the imposition of administrative fines (Finance Policy Rules of the Data Protection Authority 2016), Stcrt.2016,2043. 5Finance Policy Rules, p.10-11. 20/41Date Unidentified May 31, 2021 [CONFIDENTIAL] 4.3.1Seriousnessoftheviolation Any processing of personal data must be done properly and lawfully organizationswithprocessingdatainfringetheprivacyofcitizensitof it is very important that they apply a level of security appropriate to risk. When determining risk for the data subject include the nature of the personal data and scope of the processing important: these factors determine potential damage for the individual involved in, for example, loss, alteration or unlawful processing of the data. As the data becomes more sensitive character, or the context in which they are used, is a greater threat to personal privacy, stricter requirements are imposed on the security of personal data. The APconcludedthatUWVinsufficientlyhasarisk-adjustedsecuritylevel guaranteedandguaranteedwithin the context of sending group messages via the MyWorkbook- surroundings. With regard to the nature of the data, the AP has determined that YOURVinSonar has a multitude of processes various data of a highly sensitive nature, including data about the health of persons and the BSN. Jobseekers, the sick and incapacitated for work and who are legally are required to register with UWVandthereforemustprovidetheirpersonaldata,must can be confident that YOURV properly weighs the risks that these people run. TheimpactofasecurityincidentwiththepersonaldatathatUWVprocesscanbemajor for a sizable group of persons. Thus, it may be insufficiently secure of this data leadtostigmatizationorexclusion.NowUWValsotheBSNprocesseswhatinpracticealink of different files considerably easier, is more available for persons whose data in Sonar is an additional risk of a threat to privacy. In addition to the sensitive nature of the data, UWV also processes data from a great many citizens. UWVprocessedinSonarintheperiodfrom2016to2018dataaboutan average of 4,500,000 persons. All these people were at risk because of the insufficient security level of UWV.In addition, YOURVal has leaked personal data on several occasions. Out of a total of 15.331 people has leaked YOUR data when sending group messages via the workbook.Finally the AP notes that the violation lasted 2 years and 11 months. The AP considers this very serious. In view of the above, the AP sees, on the basis of the degree of seriousness of the violation, reason to to impose a fine on YOU and increase the basic amount of the fine to €450,000. 4.3.2 Blame According to article 6, second paragraph, of the Policy Rules, the AP takes into account the extent to which the violation can be blamed on the violator. If the violation was committed intentionally or it as a result of serious culpable negligence as referred to in article 66, fourth paragraph, of the Wbp, assuming that there is a significant degree of culpability on the part of the offender. According to the parliamentary history of 'serious culpable negligence' as referred to in Article 66, fourth paragraph, of the Wbp, applies if “the violation is the result of serious culpable negligence, i.e. 21/41Date Unidentified May 31, 2021 [CONFIDENTIAL] the result of gross, considerably careless, negligent or injudicious action.” In this connection 60 it is noted that by “acting” as referred to herein, is also meant an omission. YOURFISH believes that the findings of the AP do not follow that there are serious culpable negligence. The first four data leaks were for YOUR reason to make serious adjustments in the process to implement and invest in awareness of the risks associated with manual processing. According to YOURViserbetweenthefifthandtheeighthdataleakdeployedonstrengtheningthisorganizational measures(such as workshops).According to UWVdate,thismeansintheprocessforsending groupmessagesintheMyWorkbookenvironmentalrightisdeployedforsecurity measures to improve. The AP does not follow this view of UWV and motivates this as follows. YOUR Fish is obligated to use a security level that matches the nature and scope of the processing and that UWV now that YOURV has not ensured an adequate level of security for years, the AP believes that YOU have been seriously negligent in failing to weigh up the risks to citizens, in taking appropriate security measures and check and adjust these measures. For the organizational measures that have been implemented in accordance with YOURVwelfare, UWV has not based these measures on risk assessments and how they have considered the possible consequences for those involved YOURVindicatedthatithasnotcheckedorthemeasurestakenafterthedataleak have actually been introduced and evaluated. The Wbp, the AVG and the CBP guidelines regarding the security of the processing of personal data have expressly described that organizations are risk-adjusted security level.UWVmaybecomeconsideringthesensitivegroundandlargesize the processing is expected to be aware of the standards that apply to it there acts accordingly. In addition, the AP considers it very negligent and negligent that UWV only leaks no data in December 2018has proceededtoimplementtechnicalmeasures.Namelyblockingthe ability to add, among others, Excel files, when sending group messages via the Myworkbook environment.Citizenswhobecomeobligedtoprovidepersonaldata assume that the UW will take the necessary measures to their to protect personal data. The AP considers the fact that YOURVook has not complied with its own policy rules. that the policy of UWV indicates that measures must be taken on the basis of explicit risk assessments as part of a PDCA cycle, UWV did not take sufficient account with the risks and consequences for job seekers. In addition, UWV did not have a technical measureintroducedwhileUWVon20October2016alreadydecidedonshortterma to start an investigation into the possibility of taking technical measures. It also has UWV 59 60Parliamentary PapersII2014/15.33662,no.16,p.1. ActsII2014/15,51,item9,p.11. 22/41Date Unidentified May 31, 2021 [CONFIDENTIAL] not checked whether the measures that were taken in response to the data leaks were have actually been introduced into the organization. The violation is therefore the consequence ofgrofen Significantly negligent actions by UWV. In the opinion of the AP, all of the above shows that UWV grossly, considerably careless or acted negligently, resulting in serious culpable negligence on the part of UWV. In view of the circumstances of this case and the criterion of seriously culpable negligence Under the Wbp, however, the AP sees no reason to reduce or further increase the fine. 4.3.3Proportionality Finally, the AP assesses on the basis of article 5:46 of the General Administrative Law Act codifiedproportionalityprincipleortheapplicationofitspolicytodeterminealtitude of the fine, given the circumstances of the specific case, does not lead to a disproportionate outcome. The AP believes that, given the seriousness of the violation and the extent to which it can be charged to UWV accused, (the amount of) the fine is proportional. The organizational measures that according to UWVwel are affected, according to the AP, the present infringement of article 13 of the Wb and article 32, first and the second paragraph, of the AVG, not removed. Not weighing the risks for citizens, the lack of have appropriate security measures and fail to check and evaluate these measures after all, led to an insufficiently risk-adjusted security level in addition, it took almost 3 years with the privacy of 4,500,000 persons not being sufficiently guaranteed. In view of all the circumstances of this case, the AP sees no reason for the amount of the fine based on the circumstances mentioned in proportion and at the end of the Fine Policy, as applicable in the present case, further increase or decrease. 4.4 Conclusion The AP sets the total fine at €450,000. 6For the justification, see paragraphs 4.3.1 and 4.3.2. 23/41Date Unidentified May 31, 2021 [CONFIDENTIAL] 5.Dictum The AP submits to the Implementing Institute Employee Insurance for Violation of Article 13 of the Wbpen article 32, first stone, second paragraph, of the AV No administrative fine on the amount of €450,000 (say four hundred and fifty thousand euros). Yours sincerely, AuthorityPersonal Data, w.g. drs.C.E.Mur board member Remedies Clause If you do not agree with this decision, you can within six weeks of the date of shipment of the decide to submit an objection digitally or on paper to the Data Protection Authority. Submit it of an objection suspends the effect of this decision. To submit a digital objection, see www.autoriteitpersoonsgegevens.nl, under the heading 'Objection', at the bottom of the page under the heading ‘Contact with the Data Authority’. The address for submission on paper is: Authority Personal data, P.O. Box93374,2509AJDenHaag. Mention on the envelope 'Awb-objection' and put in the title of your letter 'objection'. Write your objection at least: Your name and address The date of your notice of objection The reference (case number) mentioned in this letter; you can also receive a copy of this decision attach The reason(s) why you do not agree with this decision Your signature For more information, see: https://autoriteitpersoonsgegevens.nl/nl/bezwaar-maken 6The AP will hand over the aforementioned claim to the Central Judicial Collection Agency (CJIB). 24/41Date Unidentified May 31, 2021 [CONFIDENTIAL] Attachment 1 1. Policy of UWV UWV has in its policy documents “Strategic Policy Information Security and Privacy (IB&P)”, which apply for the period 2016-2020, included: “that management takes decisions based on careful consideration of the risks”. It also states the following: “Depending on the results of the analyses, risks are an adequate system of measures neutralized or explicitly accepted by a director central registration. UWV continues to ensure that continuity, quality and safety are guaranteed. means that risks are detected early and dealt with in a professional manner”. 64 VoorsthasUWFindpolicydocuments“TacticalPolicy,Information SecurityandPrivacy(IB&P)Legal Framework”, which was valid from April 2016 to at least January 2019, included the following: processing and storage of data are required technical and organizational security measures 65 a risk-driven way selected and realized, in accordance withUWVTacticalIB&PPolicySectionB‘BIRUWV’.” UWV has in its policy documents, which are valid from April 2016 until at least January 2019, the following is included: “In the processing and storage of data, the required technical and organizational security measures selected and realized in a risk-driven manner, in accordance with UWV 66 TacticalIB&PPolicySectionB'BIRUWV'. With regard to checking, evaluating and adjusting measures, YOU put in her 67 policy document, valid from December 2015 to at least January 2019: “4.2.The organizational units: primary actors IB&P risk management is primarily invested in the organizational units themselves. reported, in accordance with the own agreements. From the central monitoring of the IB&P risks, the organizational units were asked to report on the UWV-widetop IB&P risks. The organizational units have the following responsibilities: • Reporting from the executive responsibility on the progress of the victorious prioritized measures and improvement actions (using a format) and any new IB&P risks through the divisional reporting; • Periodically reassess the (BIR) improvement plans with improvement actions based on the UWV-wide identified IB&P risks; 63 See file 38 (Excel file, attachment 6 (file “UWVBZIBP Strategic Policyv190”, p.7)) and attachment 11 (file "UWVBZIBP" StrategicPolicyv202(AVG version)", p7-8).These attachmentsarepartoffile“Document”inanswertoquestion4below data breach1). 64 Ditto. 65See file document38(Excel file, attachment7(file“UWVBZIBPSectionAWelijkFrameworkv100.docx”,p.11)andappendix10(file "YOURVBZIBPSectionAuthorizedFrameworkv102(AVG version)",p.12).Theseattachmentsarepartoffile“Document”inresponseto question4onderdata leak1). 66See dossier document38(Excel file, attachment 7(file“UWVBZIBPSectionAWelijkFrameworkv100.docx”,p.11)andappendix10(file "YOURVBZIBPSectionAuthorizedFrameworkv102(AVG version)",p.12).Theseattachmentsarepartoffile“Document”inresponseto question4onderdata leak1). 67Seefiledocument38(Excel file,appendix9(file“UWVBZIBPSectieCBorgingBIRControlv200”whichispartof file“Document”foranswertoquestion4underdatalek1,p.7-8)). 25/41Date Unidentified May 31, 2021 [CONFIDENTIAL] • Implementing own risk inventory measures based on the prioritized UWV-wide IB&P risks and maintained (via the improvement plans). 4.3. Administrative affairs: coordinating role The substantive support and monitoring for IB&Pis centrally invested in Administrative Affairs. Governance is responsible for the coordination and the overall picture of the IB&P risks. obtaining the overall picture, the Board of Directors carries out the following activities: • Monitoring the progress in the realization of actions and measures in the field of IB&P, such as progress on the improvement plans; • Periodically conducting a substantive qualitative investigation (Quality Assurance) into the status of the IB&P improvement actions and management of the top IB&P risks at the organizational units; • Delivery of an IB&P report to the Coalition IB&P and the Board of Directors, periodically or at particularities; • Coordinating the annual exercise of the assessment of the UWV-wide risks and (BIR) improvement plans; • Providing substantive support about the improvement plans and actions to be carried out; 68 • Keeping the overview of the most important UWV-wide IB&P risks up-to-date”. 2.PracticewithinUWV 2.1 Weighing the risks in practice UWV indicates that it is: “an organization that generally and is also pragmatic in investigating and preventing data leaks. UWV opts for a pragmatic approach with concrete improvements instead of bulky reports. Documents that we, for example, as 'risk analysis' can be called 'research' by the department, which makes it understandably only 69 wrong may give the impression that we are not complete”. To the question whether before the decision in 2012 to group messages in any other way than through Outlook sending a risk analysis has been carried out, UWV reports: “There is a risk of sending group messages via the workbook no risk analysis prepared”. 70 When asked howYOURVin2012determinedthatsendinggroupmessagesviatheMyWorkbook- environment is an acceptable risk, what security measures have been considered and what the trade-off is has been created, UWV replies: “The work folder has a link with SONARenwerk.nl, and the customer must ofhis/herDigiDintlogintoopenandseemessages.In addition,–unlike-can access sending via outlook - once sent messages will be deleted if a message is sent incorrectly. the workbook as one of the secure channels to exchange data and messages with”. 71 68Seefiledocument38(Excel file,appendix9(file“UWVBZIBPSectieCBorgingBIRControlv200”which is part of file“Document”foranswertoquestion4underdatalek1,p.7-8)). 69See file document 46 (Reply by UWV, appendix 2 (file “Letter AP information request 29042019”, p.1)). 70See file document98(Reply by UWV, file"Additional questionsAP2110",p.2,appendix4(file"Explanation note meetingExecutive teamWORKcompany”) and attachment5(file“28BV06DecisiondocumentforbidusegroupmailviaOutlook”)). 71See file document98 (Reply by UWV, file "Additional questions AP2110", p. 2). 26/41Date Unidentified May 31, 2021 [CONFIDENTIAL] To the question whether the specific data leaks have led to the carrying out of a risk analysis indicates UWVaan:“YOURVeninthespecialdivisionWORKcompanyhasareasonofthefourleaksin2016a risk analysis has been carried out. This risk analysis can be found in the document: 'Proposer DMOWERKbedrijf' and its appendices, containing guidelines for employees”. Inthisoctober2016submitteristhenext included: “To face the unrest and disrupt the service as little as possible, but at the same time to conduct a thorough analysis of where we run our customer communication risks, we propose the following measures in front of(…)". 73 In response to the question whether a risk analysis was carried out after each data, UWV stated the following: “During 2016, UWV saw no need to carry out a PIA as such. The Business Security Officer (BSO) of Werkbedrijf has made an evaluation (sic) for the District Managers regarding the data leaks in August September2016.See hereforthesubmitter-aproposalfordecision-making-of the 4quarter2016 of the BSO WORKING company with which to take decisions/impact analysis/measures and conclusions and recommendations. appendixaguidelineSafeCommunicationatWERKbedrijf.Duedatein2017oneleakwassawUWVnonecessary to adjust the policy and to carry out a PIA. After the two leaks in 2018, the Board of Directors has Data protection requested to start an investigation”. 74 UWV indicates on the question why the leak in 2017 saw no need to carry out a risk analysis the following to:“UWVhasconsideredandofcoursegivenweighttotherightsand 75 freedoms of those involved. Now, with today's knowledge, this trade-off may be different”. UWVhas on request, no documents were supplied in which the assessment made at the time is recorded. With regard to the data leaks, five to eight UWV reports: “The risk of more leaks became low considered measures from October 2016 to work sufficiently, as explained again in the answer of the information request. At that moment, a number of other ICT measures in the systems have a high priority. 76 In hindsight, it was a misjudgment that the technical measures should have been taken sooner.” UWV has not substantiated what the estimate was based on that the risk should be considered low considered. UWV has stated in relation to the eighth data breach: “The Data Protection Officer (DPO) has As a result of this data, an investigation was conducted into export functionality within the workbook. After that (sic) performs the Data Protection Officer (DPO) on behalf of the Board of Directors is currently conducting a risk analysis on Sonar”.77 72See file document 46 (Reply by UWV, appendix 2 (file “Letter AP information request 29042019”, p.1)). 73See, among others, file document38(Excel file, attachment27(file“MicrosoftWord97-2003 document”in response to11underdataleak1 to 4, p.2)) and file 102 (Reply by UWV, appendix 2 (file “42DMO-B04.161017ESNotitieDMOWB", p.2)). 74See, among other things, file document38 (Excel file, reply to 11 under data leak1 to 4). 75 76See file document 81 (Reply by UWV, appendix 1 (file "Answering questionsAPAugust 2019", answer to question 12)). See file documents65 and 66 (Reply by UWV, p.2). 77See, among other things, file document38 (Excel file, reply to 11 under data leak7). 27/41Date Unidentified May 31, 2021 [CONFIDENTIAL] 2.2Measures, checks and adjustments in practice Temporary measures of 28 September 2016 UWV states that it was necessary the measures that were in place before the fourth data leaked evaluate and that it has decided to take measures. 78 With regard to the measures taken after the four data leaks in 2016, UWV reported: “Then are immediate 79 organizational and process measures taken to mitigate the risks and recurrence”. from the submitter from 18 October 2016 it appears that the “DTWERK company” on 28 September 2016-after the fourth data breach-until the had decided on the following temporary measures, which relate to the sending of messages with attachments via the MyWorkbook environment to multiple job seekers at the same time: 80 On 30 September 2016, these temporary measures and instructions were communicated to the managers 81 from the WORK company via the following WORK message: 78See, among other things, file document38(Excel file,answertoquestion18underdataleak1t/m4). 79See file documents65 and 66 (Reply by UWV, p.1). 80See file documents 65 and 66 (Reply by UWV, appendix, answer to question2) and file document 102 (Reply by UWV), 81jlage2(file“42DMO-B04.161017ESNotitieDMOWB",p.1). See file document 98 (Reply by UWV, appendix 2 (file "Work message 30 September 2016", p. 2 and 3)). 28/41Date Unidentified May 31, 2021 [CONFIDENTIAL] UWV states that these temporary measures and instructions were communicated to . on 4 October 2016 all (then employed) employees via a newsletter WORK In Performance with the following text: 82 UWVindicatesonthepreviouspagementionedtemporarymeasuresthattheywillbecompleted asap came into effect after 28 September 2016. UWV also states that in view of the importance of these measures andtherelevantforthetypeofrisksmainlyinvolved inthistypeofdataleaks,thesetemporarymeasures would still be in effect at this time. However, UWV has not substantiated this with documents. 82See file document98 (Reply by UWV, appendix 3 (file “WIU4October 2016”)). 8See file documents65 and 66 (answer by UWV, appendix, answer to question 2). 29/41Date Unidentified May 31, 2021 [CONFIDENTIAL] Measuresproposed in October 2016 In the submission of October 18, 2016, which has been drawn up in preparation for the District Managers' Meeting (DMO) on October 20, 2016, the following is stated about the temporary measures mentioned above: 84 Therefore, in October 2016, DMO was asked to agree to the measures below, in order to replacement of the temporary measures decided on 28 September 2016: 85 84See file document102 (Reply by UWV, appendix 2(file“42DMO-B04.161017ESNotitieDMOWB",p.2)). 85See file document102 (Reply by UWV, appendix 2(file“42DMO-B04.161017ESNotitieDMOWB",p.2)). 30/41Date Unidentified May 31, 2021 [CONFIDENTIAL] During the DMO of October 20, 2016, it was noted that the measures proposed above 86 followingdecided: It follows from these minutes that the DMO on October 20, 2016 only with the (mentioned on page 30) measures 1 to 6 has agreed. In addition, it has been decided that measures 7 to 10 - including an investigation into concrete technical measures in the short term. UWV indicates that all measures (mentioned on page 30) have been implemented. UWV has 87 not (sufficiently) substantiated if the implementation has taken place. Of the measures 1 to 6 has YOURV only shown that the “Guideline safe communication at WORK company” is drawn up. As seen below, these undated-Guideline principles for 89 safe communication: 86 See file document 102 (Reply by UWV, appendix 1 (file “42DMO-A04. Decisions and action points overview 20Oct.2016”, p.3 and4)). 87 See file 38 (Excel file, answer to question 14 under data leak1). 88Seefiledocument38(Excel file,attachment33(file"161020AttachmentADDataLeaksWB",whichispartoffile"Microsoft Word document"in response to question15underdata leak1)). 89Seefiledocument38(Excel file,attachment33(file"161020attachmentADDataLeaksWB",whichispartoffile"Microsoft Word document"in response to question15underdata leak1)). 31/41Date Unidentified May 31, 2021 [CONFIDENTIAL] From page 30 and 31 it follows that the DMO decided on 20 October 2016 to conduct an investigation into the to postpone the possibilities of technical measures until further notice. To the question whether this investigation 90 took place, UWV answered: “No, this investigation did not take place”. UWV reports with regard to the question of how it has been checked or proposed measures after each data breach have also actually been introduced: “YOURVandWORKcompanyhavenotas suchcheckedormeasuresthat have been taken as a result of data leaks have actually been implemented. UWV has no generic policy in which it checks whether UWV central measures have been implemented by the responsible division(s). 90 See file documents65 and 66 (answer by UWV, appendix, p.1, answer to question 3). 32/41Date Unidentified May 31, 2021 [CONFIDENTIAL] WORKcompanyoperating throughoutthe country can give regional offices to a certain extent their own interpretation 91 central policy, for example awareness campaigns”. UWV also reports about this: “There is no formalform protocolled procedure within UWV, which is checked or agreed upon at a central level organizational and process measures are carried out. That would be impracticable given the size of the organization and the amount of decisions that UWV takes”. UWV mentions its response to the actual findings, however, that she would have checked whether the measures taken in practice have been brought. Your statement has not been substantiated with documentation. On the question whether and in what way the measures to which UWV in response to the first four data leaks had decided have been evaluated, what the results of that evaluation were and whether the desired effect of that measures had been achieved, UWV reports: “No, given the absolute limited number of leaks from 2017 compared to 2016, UWV saw no reason to assume that the mitigating measures did not correctly address the risks addressees”. And: “In 2017, given the relatively small number of leaks(1), UWV saw no reason to exist 95 evaluate measures”. UWVstatesthe following about the way in which it carries out evaluation:“There is no formal protocolledevaluationprocessaftereachofthesevendataleaks.ThatisnotthewayYouWVinalle casesworks.Involveddepartmentsconcludedovera long time in close consultationthatthetakenin2016 measures were sufficient. Unfortunately, this conclusion turned out to be incorrect”. UWV mentions its response to the actual 97 findings, however, that evaluations have been carried out with regard to measures taken. This one Your statement has not been substantiated. Fifth data breach UWVindicatedthatafterthefifthdataleak,itiscontinuedtoincreaseawarenesswiththe 98 sending messages via the MyWorkbook environment. InthatframeafterthedataleakheadedJuly 20,2017 The following WORK message sent to WORK company managers by UWV: 99 91See file 38 (Excel file, answer to question 16 under data leak 1 to 7). 92See file documents65 and 66 (Reply by UWV, appendix, p.2, answer to question 4). 93See file documents109 and 116 (UW's response to factual findings, p.3). 94See, among other things, file document38 (Excel file, answer to question 18 under data leak6). 95 See, among other things, file document38 (Excel file, answer to question 18 under data leak1 to 4). 96See file documents65 and 66 (Reply by UWV, appendix, p.2, answer to question 5). 97See file documents109 and 116 (UW's response to factual findings, p.3). 98See, among other things, file document38 (Excel file, answer to question 13 under data leak5). 99See file 38(Excel file, attachment31(file"MicrosoftWord document"inanswertoquestion14underdataleak5)). 33/41Date Unidentified May 31, 2021 [CONFIDENTIAL] UWV also states with regard to this data leak: "UWV/WERKbedrijf has as a result of this leak the Directive 'Safe communicating'”and UWV has adopted the “Guideline for safe communication at WORK company” with the answering questions about the fifth data breach. 10Based on what it says on page 31, it seems following, however, that this guideline had already been drafted after the fourth data breach. And as already mentioned, UWV has not provided any proof that the measure has actually been introduced or checked. UWV further states with regard to the fifth data leak in 2017: “Important for the decision on less time, after this leak, no additional technical measures to take was only for a full release agenda, in combination with a far-reaching change assignment for WERKbedrijf”. UWV has not supplied any documents in which this decision is contained. UWV has with regard to the question of how it has been checked that the measures mentioned are also have actually performedansweredthatYOURVandWORKcompanyhavenotassuch checked whether measures taken in response to data leaks are real 102 implemented. 10See, among other things, file document38 (Excel file, answer to question 18 under data leak5). 10See file document 81 (Reply by UWV, appendix 1 (file "Answering questionsAPAugust 2019"), answer to question 12). 10See file 38 (Excel file, answer to question 16 under data leak 1 to 7). 34/41Date Unidentified May 31, 2021 [CONFIDENTIAL] To the question whether and in what way the measures that UW had decided upon after the fifth data leak evaluated, what the results of that evaluation were and whether the desired effect of those measures was reached, UWV reports: "No evaluation has taken place after this because it was considered an incident for which mitigating measures seemed effective at the time". 103 With regard to the way in which it carries out evaluations of measures, UWV states the following: “There is no formally protocolled through the evaluation process after each of the seven data leaks. That is not the way UWV works in all cases.Involveddepartmentsconcludedovera long time in close consultationthatthetakenin2016 measures were sufficient. Unfortunately, this conclusion turned out to be incorrect”.10UWV states its reaction to the actual 105 findings, however, that evaluations have been carried out with regard to measures taken. This one statement that there would have been evaluated is not substantiated with documentation from which the evaluation actually turns out. Sixthtotenwithninthdata breach(2018) UWV has indicated that there are no measures due to the sixth data leak on March 26, 2018 affected.106According toUWVisaftertheseventhdateheadedMarch 28th,2018andtheeighthdataheadedAugust 3rd 107 2018,decided onthefollowingmeasures: "-WorkshopPreventionData Leaks This concerns a workshop aimed at raising awareness about working with personal data and performing risk assessments together. The workshop has been transferred to representatives from all through the ‘train the trainer’ labor market regions, which subsequently rolled out the training across the branches. -Frequently used toolkit page on DWU Due to the introduction of AVG, the toolkit page of the IB&P is further expanded and there is a lot of material offered. This part supports the above workshop. -Step-by-step plan Safe Personal data sharing In light of the entry into force of the GDPR, the old directive 'Safer Digital Communication' has been replaced by the guideline 'Step-by-step plan for Safe Sharing of personal data' -Attentiononmanagement An annual consultation meeting Information Security & Privacy and Security takes place with the regional management. currently running a UWVwide IB&Ptrainingformanagerswithin itabreakoutsession‘data leaksandrole management therein' -RolloutSLIM In the roll-out of SMARTWork, there is much more focus on working safely and preventing data leaks. MT sessions, as well as during branch wide kick-offs. Technical measure: 10See, among other things, file document38 (Excel file, answer to question 18 under data leak5). 10See file documents65 and 66 (Reply by UWV, appendix, p.2, answer to question 5). 10See file documents109 and 116 (UWV's response to factual findings, p.3). 10See file document 81 (Reply by UWV, appendix 3 (file "Question 7 appendix 2")). 10See, among other things, file document38 (Excel file, answer to question 13 under data leak 6 and 7). 35/41Date Unidentified May 31, 2021 [CONFIDENTIAL] Attachments block WERKbedrijf made it impossible through an early release on the weekend of 15/16 December 2019(sic) made to attach noglangero.a.Excel files in the Workbook to messages.” With the exception of the measures regarding the “Step-by-step plan Safe Sharing of Personal Information” and the technical measure has not supplied any documents or further substantiation on the basis of of which it can be established how the above measures are secured in documentation. Furthermore, it has not become clear when the above measures have been implemented. UWV has supplied a version of the “Step-by-step plan for Safe Sharing of Personal Information”. That step-by-step plan is dated 26 April 2018 and thus drafted after the seventh date. UWV declares about this: “In hetlicht of the entry into force of the GDPR, the old directive 'Safer Digital Communication' has been replaced by the directive "Step-by-step plan for Safe Sharing of personal data". This step-by-step plan looks like this: 108 See file 38 (Excel file, answer to question 13 under data leak 6 and 7). 36/41Date Unidentified May 31, 2021 [CONFIDENTIAL] 37/41Date Unidentified May 31, 2021 [CONFIDENTIAL] The step-by-step plan is on May 1, 2018 via the newsletter to employees of the WERKbedrijf communicated: 109 To the question whether there are technical measures between the first stone and the eighth date on August 3, 2018 implemented, UWV replied: “UWV did not implement any technical measure during that period, but several organizational and process-related measures have been implemented.However, we are of the opinion that this fact must be viewed in the light of the risk assessment that UWV made at the time and the earlier outlined the area of IB&P measures as a result of targets, which is described in the letter”. 110 After the eighth data leak, UWVanalyzed on August 20, 2018 how the data leak could have been take place and how specific data leak direction involved is handled. This analysis is described 111 in a document containing the following recommendations: 109 See file documents 109 and 116 (UWV response to factual findings, appendix “WORK in progress”, item 07). 11See file documents65 and 66 (Reply by UWV, appendix, p.1, answer to question 1). 11See file document38(Excel file, attachment42(file“MicrosoftWord document”in response to question18underdataleak7),p.3). 38/41Date Unidentified May 31, 2021 [CONFIDENTIAL] Furthermore, about the above-mentioned analysis, UWV stated: “First of all, WERKbedrijf in September 2018based onananalysisofwaterfailurewentinAlkmaar(…)-notfollowingtheorganizationaland process-basedsecurityrules-onnewinstructionsent toemployeesforhandlingbulkmessagesvia the Briefcase to prevent this type from leaking. More research in the sense of a comprehensive report is not here basisbecausethecausewasclear.(…)BasedonthisanalysisUWVookdecidedtotaketechnicalmeasures take-whereasbeforedeterminedthatorganizationalandprocess-relatedsecuritymeasuresweresufficient-i.e.a block in the work folder that prevents ero.a. no longer sending excel files, which means mid 112 December has happened”. On September 3, 2018, so one month after the eighth dates, it seemed two days before the ninth data breach,the QRCgroupmessagesextendedwithaframethepassagewithinstructionstodataleak prevent: 113 11See file document 46 (Reply by UWV, appendix 2 (file “Letter AP information request 29042019”), p.1). 11See file document91 (Reply by UWV, appendix 4(file "QRCSonarSend group message to the Werkmap22072013", p.1)). 39/41Date Unidentified May 31, 2021 [CONFIDENTIAL] At the first point in the above-mentioned passage from QRC group messages of September 3, 2018 states that the export lists for the sending of group messages must first be carried out by the employees be cleaned by removing data from the file, leaving only the row ID about.Furthermore, this version of the QRC group messages states that the 4-eyes principle must be used In earlier versions of the QRC group messages provided, these instructions about the clean and the row ID and the 4-eye principle are not included. On September 4, 2018, the AP had a telephone consultation with the FG of UWV. others considered whether technical measures had meanwhile been introduced. In that conversation the FG has indicated that, to his knowledge, no technical measures had been introduced. He further indicated that the four-eyes principle had been introduced. He thought thatthemethodinherentisnotsecurewhendataisextractedfromasystemandina office application continue to be processed. He was of the opinion that employees of UWV immediately system must work that does not have sufficient guarantees. 114 In response to the eighth data, the FG of UWV has been requested by the Board of Directors of UWVinvestigatedanddescribedthisinthe“FGreportoffindings:DatalekAlkmaar”of30 115 November2018. The results of that investigation presented to the Council of on 22 January 2019 Board of Directors Work company presented. Indie presentation includes: 11See file document22 (Telephone note FGUWV). 11See file document81, appendix5 (file "Question16_ConceptFG report") and file documents109and116(ReactionUWVtofactual findings, p.3). 11See file document38(Excel file,answertoquestion11underdataleak7)andfilepiece51(file“ResultsFG investigation Werkbedrijfv010”, p.7en9). 40/41Date Unidentified May 31, 2021 [CONFIDENTIAL] “Measure to disable the upload of Excel files to the workbook is working for this specific leak. (…) “Plasters Paste: Process agreements are not ‘hard’ enforced”(…) “Policy Doesn't Come to the Workplace: Understanding process agreements Awereness does not reach all employees” Finally, in mid-December 2018, UWV introduced a technical measure, namely blocking of the ability to add, among other things, Excel files, when sending group messaging through the Myworkbook environment. 117 UWV has with regard to the question of how it has been checked whether measures are actually enteredansweredthatYOUVandWERKcompanyhavenotcheckedassuchormeasuresthat 118 have been taken as a result of data leaks have actually been introduced. When asked whether UW had external parties investigated the data breaches, yourWV replies with regard to the first eight data breaches:“YourV did not see any added data at the time value in having an external investigation carried out because given the measures taken, the risk is mitigated 119 seemed”. UWVhasconsideredtheeighthdataleak:“UWVInternal InvestigationbyAdministrative Affairs commissioned by FG where external expertise was gained from a consultant”. 120 UWVstatesthe following about the way in which it carries out evaluation:“There is no formal protocolledevaluationprocessaftereachofthesevendataleaks.ThatisnotthewayYouWVinalle casesworks.Involveddepartmentsconcludedovera long time in close consultationthatthetakenin2016 measures were sufficient. Unfortunately, this conclusion turned out to be incorrect”. UWV mentions its response to the actual 122 findings, however, that evaluations have been carried out with regard to measures taken. This one statement that there would have been evaluated is not substantiated with documentation from which the evaluation actually turns out. 11See file document38 (Reply by UWV, letter), file document38 (Excel file, answer to question 13 under data leak6 and7), file documents 65 and 66 (Reply by UWV, p.2 and appendix, p. 1, answer to question2) and file document 81 (Reply by UWV, appendix 1 (file "Answering questionsAPAugust2019", answer to question 17)). 11See, among other things, file document38 (Excel file, answer to question 17 under data leak1 to 7). 11See file document38(Excel file,answertoquestion12underdataleak1t/m6). 120 121iefilepiece38(Excel file,answertoquestion12underdataleak7). See file documents65 and 66 (answer by UWV, appendix, p.2, answer to question 5). 12See file documents109 and 116 (UWV's response to factual findings, p.3). 41/41