Sweden IMY Fines Miljödata AB 2 Million SEK ($183,000) Over Breach Exposing 2.2 Million Records of Personal Environmental Data

Summary

Sweden’s Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) has fined Miljödata AB 2 million SEK (approximately $183,000 USD) following a data breach that exposed 2.2 million records containing personal data linked to Swedish environmental permits, inspection reports, and regulatory filings. Miljödata AB operates a database of Swedish environmental regulatory information used by municipalities, businesses, and environmental consultants. The breach exposed records containing personal identification numbers, contact information, business registration details, and environmental compliance data. IMY determined that Miljödata AB failed to implement adequate technical and organizational security measures required under GDPR Article 32, and that the company’s breach notification to IMY was delayed beyond the mandatory 72-hour reporting window.

Timeline

What Happened

Miljödata AB operates a commercial database aggregating Swedish environmental regulatory records — permits, inspection reports, pollution incidents, and compliance filings — maintained by Swedish municipalities and regional authorities under environmental protection legislation. The database is used by environmental consultants conducting due diligence, municipalities tracking compliance, and businesses managing their regulatory obligations. Because Swedish environmental permits are linked to named individuals and legal entities with personal identification numbers, the database contains a significant volume of personal data as defined under GDPR.

The breach occurred when unauthorized access to Miljödata AB’s systems resulted in the extraction of 2.2 million records. The exposed data includes personal identification numbers linked to permit holders and responsible parties, contact details, property addresses, business registration information, and the content of environmental inspection reports. IMY’s investigation determined that Miljödata AB had not implemented access controls, encryption at rest, or network monitoring adequate to meet the standard of care GDPR Article 32 requires for a database of this sensitivity and scale.

The delayed breach notification was an aggravating factor in IMY’s penalty assessment. GDPR Article 33 requires data controllers to notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach. Miljödata AB’s notification fell outside this window without adequate justification, which IMY treated as a separate compliance failure. The 2 million SEK fine represents a substantial penalty for a mid-sized Swedish data services company. IMY also issued a corrective order requiring Miljödata AB to implement specified technical controls within a defined remediation period.

Domain Intelligence

miljodata.se — 71.0

miljodata.se scores at 71.0, in the high-trust range — notable for a mid-sized Swedish data services company. The T5_SPARSE flag indicates limited topology-layer coverage in the engine’s corpus, which constrains the confidence of the underlying topology signals despite the score falling in the high-trust range. Miljödata AB is the fined organization and the party whose breach is the subject of this bulletin.