Primary Health Care in the Capital Area
€34,300
Insufficient legal basis for data processing
Dato for beslutning
17. februar 2025
Myndighet
Icelandic data protection authority ('Persónuvernd')
IS
Sektor
Health Care
Land
IS
Lov og rett
GDPRStatus
FINALBeskrivelse
The Icelandic DPA has imposed a fine of EUR 34,300 on the Primary Health Care in the Capital Area. The controller processed personal and health data in shared medical record systems by merging its medical records with those of other parties and granting them access to its patients' records.
Juridiske henvisninger
Art. 5 (1)Art. 6 (1)Art. 9 (2)
Problemer og overtredelser
Insufficient legal basis for data processing