Court of Appeal cuts health data security fine to 4.5 million krónur

Iceland’s Court of Appeal has reduced a fine imposed on the Office of the Director of Health over security flaws in the Heilsuvera website from eight million to 4.5 million krónur, mbl.is reports. The court upheld a finding that the office had acted negligently by failing to meet its duties to protect personal data.

The court said the flaws had not been exploited and caused no harm, and that the office had acted quickly once they were discovered. It also reduced the fine in line with the principle of proportionality in administrative law.

Iceland’s Data Protection Authority initially fined the office 12 million krónur. Reykjavik District Court lowered the amount to eight million in June 2025. The Court of Appeal rejected the office’s request to overturn the authority’s decision or cancel the fine.

Two security flaws

The flaws were discovered on June 8, 2020. One had been present since 2015 and allowed logged-in users to change a link in Heilsuvera’s messaging section and view messages intended for other people.

The other flaw had been present in the website’s maternity care section since September 2019. Some expectant mothers who could retrieve ultrasound images from the medical record systems of the Suðurnes and Southland health institutions could change a web address to access other attachments and data in those systems.

The Data Protection Authority concluded in June 2023 that the office had not adequately secured the personal information and imposed the original fine.

Regular testing was lacking

The Court of Appeal said the office, as the party responsible for processing the data, had a duty to protect it. That included regularly testing and assessing the effectiveness of security measures.

The court referred to two independent reviews of the website’s information security, conducted in September 2014, before Heilsuvera began operating, and in the first half of 2017. The earlier review had called for regular reassessment of risk and security measures.

However, there was no evidence that the office had ensured regular security testing of the website. Its lawyer told the court that no specific procedures had been established for that purpose. The office also acknowledged that security had not been adequately considered when the maternity care section was added in September 2019, and that no specific data security review was carried out at the time.

The court considered the breach serious because sensitive health information was at stake. The office fixed the vulnerabilities on the day they were discovered.