GDPR breach (my assessment): Gjensidige's compliance department sent a password in plaintext

GDPR breach (my assessment)

What Happened

In connection with Case 4 (asbestos), a member of Gjensidige's compliance department sent a document password in a plaintext email. The password was for a document containing personal data about the Claimant. The password followed a predictable pattern consisting of the company name plus the current year.

Why I Consider It Contrary to the Rules

GDPR Article 32 (Security of processing) requires the data controller to implement "appropriate technical and organisational measures" to ensure a level of security appropriate to the risk. In my assessment, sending a password in plaintext by email is contrary to this obligation.

GDPR Article 5(1)(f) establishes the principle of "integrity and confidentiality" — personal data must be processed in a manner ensuring appropriate security.

The Danish Data Protection Act § 41 establishes criminal penalties for violations of GDPR's security requirements. Breach of the obligation to implement appropriate security measures, per GDPR Art. 32, is punishable by fine.

Aggravating Circumstances

1. It was a member of the compliance department: The very department whose job is to ensure GDPR compliance in my assessment breached the security rules
2. The password was predictable: The password followed the pattern: company name + current year + exclamation mark. In my assessment, this does not meet good password practice
3. The content was sensitive: The document contained personal data relating to an insurance case
4. Email is unencrypted in transit: Emails are transmitted in plaintext over the internet by default

Legal Consequence

A breach of Article 32 falls under the fine tier in Article 83(4) (up to EUR 10 million or 2% of global annual turnover). Breaches of the principles in Article 5 fall under Article 83(5) (up to EUR 20 million or 4%).

The Claimant has filed a complaint with the Danish Data Protection Agency (Datatilsynet), per GDPR Article 77. A decision is pending.

Perspective

I cannot conclude from the available material whether this is an isolated mistake or a broader problem. The incident is documented and has been reported to the Danish Data Protection Agency.