View source for Persónuvernd (Iceland) - 2020010355

=== Holding ===
In the opinion of the DPA, InfoMentor failed to comply with the provisions of [[Article 32 GDPR#1b|Article 32(1)(b) GDPR]], [[Article 32 GDPR#1d|Article 32(1)(d) GDPR]] and [[Article 5 GDPR#1f|Article 5(1)(f) GDPR]].  

Furthermore, InfoMentor did not ensure sufficient security of the personal data of the registered individuals who were affected by the security breach when the company sent ID numbers to the wrong school and DPO and therefore breached [[Article 5 GDPR#1f|Article 5(1)(f) GDPR]]. 

The DPA ordered the company to implement procedures for responding to data breaches, including testing of such measures. Confirmation that these instructions have been complied with shall be received by the Data Protection Authority within one month from the date of this decision. 

A fine of ISK 3,500,000 has been imposed on InfoMentor.