It looks like the idea is to be very selective about who gets fined. CPS Utrecht ("Veilig Thuis") also got a data leak. Everything got leaked: from files on chi

It looks like the idea is to be very selective about who gets fined. CPS Utrecht ("Veilig Thuis") also got a data leak. Everything got leaked: from files on children, medical files on children and adults, phone calls, emails, ... the works. The fine? It wasn't even mentioned that a fine would be forthcoming. Until city hall took steps to replace the organisation they refused to modify their systems and stop the still-in-progress leak. It got to be a scandal. So clearly: the idea is to fine only people they feel like fining. Anything even tangentially related to the government (this is a private for-profit organization (running quite a decent profit I might add, as well as paying management very nicely) that merely works for the government) does not get fined, even for leaking much, much more sensitive information. Needless to say, CPS has still not changed their processes to better secure medical files. They are still being sent, without any encryption or authentication, over email. So it's not just that they weren't fined: the whole purpose of the data protection law, actually keeping the data safe, was ignored entirely even when they got caught spreading extremely sensitive information around and storing it without encryption. https://www.rtlnieuws.nl/tech/artikel/4672826/jeugdzorg-datalek-dossiers-kinderen-utrecht-email https://www.rtlnieuws.nl/tech/artikel/4672826/jeugdzorg-data...