Enforcement · Estonian Data Protection Authority (AKI) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Apotheka e-apteek: Insufficient legal basis for data processing

€100,000 Fine
Apotheka e-apteek
ESTONIA
Art. 5 GDPR Art. 6 GDPR
Healthcare IP Address Consent Personal Data Processing Agreement Processing Human Resources Supervisory Authorities
Dec 1, 2020 Source

How it connects

Related across sources

Case Law Deutsche Wohnen SE v Staatsanwaltschaft Berlin CJEU News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Case Law GC and Others v CNIL CJEU Guidance Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 EDPB

Full text

The Estonian DPA (Andmekaitse Inspektsioon) fined three online pharmacies EUR 100,000 each for processing personal data without the consent of the data subjects. The data in question are prescriptions for medicines of the data subjects. Third parties were able to view another person's current prescriptions in the e-pharmacy environment without their consent, based only on access to their personal identification code. The DPA highlighted that while it must be possible to purchase prescription drugs for other people, it is the responsibility of the company to ensure that the processing of the personal data required for this purpose only takes place with the consent of the data subjects. The confirmation of another person that they may access the data, however, does not correspond to the voluntary consent of the prescription holder, since the e-pharmacy cannot check whether and for what purpose the consent was given and whether it was given voluntarily.

Industry: Health Care

Original document at the source www.aki.ee

Similar Content