Are there really any countries that actually do this? I'd be curious to see examples of this happening.
Fairly big controversy in Norway. Bergen (the municipality) showed incredibly bad faith and the worst possible judgement. "Datatilsynet" (Norwegian Data Protection Authority) gave them a decent fine, and Bergen showed no humility, opted to dispute the fine as if the fact that a kid finding everyone's usernames and passwords was something that was a daily occurrence with no more significance than spilling coffee on one's shirt.
https://www.nrk.no/vestland/datatilsynet-star-fast-pa-millio...