Primary Health Care in the Capital Area: Insufficient legal basis for data processing

€34,300 fine - Icelandic data protection authority ('Persónuvernd')

€34,300 Fine

Primary Health Care in the Capital Area

ICELAND

Insufficient legal basis for data processing

Feb 17, 2025 Source

Content

The Icelandic DPA has imposed a fine of EUR 34,300 on the Primary Health Care in the Capital Area. The controller processed personal and health data in shared medical record systems by merging its medical records with those of other parties and granting them access to its patients' records.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR
Industry: Health Care