Enforcement · Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Uppsala hospital board: Insufficient technical and organisational measures to ensure information security

€152,000 Fine
Uppsala hospital board
SWEDEN
Art. 5 GDPR Art. 32 GDPR
Encryption Data Breaches Healthcare Integrity and Confidentiality Principle Health Data Healthcare Security Personal Data
Jan 26, 2022 Source

How it connects

Related across sources

News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 01/2021 EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review

Full text

The Swedish DPA has imposed a fine of EUR 152,000 on the Uppsala hospital board. The fine is the result of an investigation by the Uppsala Region (the regional board and the hospital board). DPA had received two reports of incidents involving personal data from Uppsala region. The incidents involved sensitive personal health data that was transferred unencrypted to recipients inside and outside Sweden. Accordingly, Uppsala University Hospital had sent emails containing patient data to patients and senders in third countries without encryption. In addition, the hospital administration had stored sensitive personal data in the Outlook email hosting service. For this reason, the DPA found that the hospital board had not taken sufficient technical and organizational measures to protect the data from unauthorized access.

Industry: Health Care

Original document at the source www.imy.se

Similar Content