Enforcement · Information Commissioner of Isle of Man EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Manx Care Ltd: Non-compliance with general data processing principles

€202,000 Fine
Manx Care Ltd
ISLE OF MAN
Art. 5 GDPR Art. 24 GDPR Art. 25 GDPR Art. 32 GDPR Art. 34 GDPR Art. 58 GDPR
Data Breaches Healthcare Personal Data Processing Agreement Security IP Address Privacy by Design & Default Processing
Jul 13, 2022 Source

How it connects

Related across sources

Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet

Full text

The DPA of Isle of Man has imposed a fine of EUR 202,000 on Manx Care Ltd. Manx Care had emailed an unsecured attachment containing a patient's confidential health information to more than 1870 recipients. The DPA had subsequently issued an enforcement notice against Manx Care. However, Manx Care had failed to comply with the DPA's orders. As a result, the DPA came to the decision to impose a fine on the company. The DPA primarily found that the company had failed to implement appropriate technical and organizational measures to protect personal data. Also, the DPA found that the company had violated the principle of data minimization according to Art. 5 (1) c) GDPR by sending the patient's data to persons not related to the patient's care. Finally, the DPA found that the company had not informed the data subject of the data breach.

Industry: Health Care

Original document at the source www.inforights.im

Similar Content