Enforcement · Autoriteit Persoonsgegevens EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Haga Hospital: Insufficient technical and organisational measures to ensure information security

€350,000 Fine
Haga Hospital
THE NETHERLANDS
Art. 32 GDPR
Healthcare Health Data Healthcare Security Supervisory Authorities Supervision
Jun 18, 2019 Source

How it connects

Related across sources

Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review Guidance Recommendations 1/2025 on the 2027 WADA World Anti-Doping Code EDPB Guidance EDPB Annual Report 2023 EDPB Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB News Garante onderzoekt het gebruik van "cookie walls". Garante Privacy News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD

Full text

Original Fine Summary: The Haga Hospital does not have a proper internal security of patient records in place. This is the conclusion of an investigation by the Dutch Data Protection Authority. This investigation followed when it appeared that dozens of hospital staff had unnecessarily checked the medical records of a well-known Dutch person. To force the hospital to improve the security of patient records, the AP simultaneously imposes an order subject to a penalty. If the Haga Hospital has not improved security before 2nd of October 2019, the hospital must pay EUR 100,000 every two weeks, with a maximum of EUR 300,000. The Haga Hospital has meanwhile indicated to take measures. Update: The fine was reduced from EUR 460,000 to EUR 350,000 following a court ruling in 2021.

Industry: Health Care

Original document at the source autoriteitpersoonsgegevens.nl

Similar Content