The Icelandic Court of Appeal reduced a public health authority’s fine to ISK 4.5 million
The case demonstrates that prompt remediation of a vulnerability does not release a controller from the duty to systematically verify the security of systems processing health data. The full text of the judgment in the Judykatura database sets out the arguments concerning regular security testing and the proportionality of the administrative fine.
The rest of this analysis, all theses and the full text of the ruling are available with an AKTUALNOŚCI PLUS subscription.
Find out how EU supervisory authorities, administrative and civil courts and the CJEU reason their decisions — and keep your organisation aligned with current case law.