The Norwegian Data Protection Authority recently fined the Høylandet Municipal Council 41,000 euros ($47,565.00) because image files containing health data about people with no connection to the municipality were accessible to staff at the health clinic, and the council still did not implement appropriate access controls after they became aware of the problem.
Read more about the complaint and decision here.