Primary Health Care in the Capital Area
€34,300
Insufficient legal basis for data processing
Date de décision
17 février 2025
Autorité
Icelandic data protection authority ('Persónuvernd')
IS
Secteur
Health Care
Pays
IS
Droit
GDPRStatut
FINALDescription
The Icelandic DPA has imposed a fine of EUR 34,300 on the Primary Health Care in the Capital Area. The controller processed personal and health data in shared medical record systems by merging its medical records with those of other parties and granting them access to its patients' records.
Citations légales
Art. 5 (1)Art. 6 (1)Art. 9 (2)
Questions et violations
Insufficient legal basis for data processing