Who was sanctioned, and for what?

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Monash IVF collected sensitive information about visitors to its fertility treatment website through third-party tracking pixels. The Privacy Commissioner held that following the visitors of health-related websites and afterwards showing them targeted adverts on social networks amounts to collecting sensitive data, which requires consent, and found breaches of APP 3.3, 5.1, 5.2 and 7.1. Monash IVF must not continue or repeat the conduct and must implement specified remedial steps; a parallel determination against the telehealth provider Medmate Australia was made on the same day.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Cookies and tracking

Legal basis

Privacy Act 1988 (Cth), APP 3.3, 5.1, 5.2, 7.1

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

24 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

In November 2018 attackers encrypted patient data in the laboratory information system of Midlands Regional Hospital Tullamore. The DPC found that the HSE had infringed Art. 5(1)(f), 28, 30, 32(1) and 34 GDPR (including insufficient security, deficient processor contracts and record of processing, and incomplete notification of affected persons), issued a reprimand, imposed €300,000 for the security failings (Art. 5(1)(f) and 32(1)) and ordered it to introduce specified policies and procedures for secure processing.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 28, 30, 32(1), 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 2 Oct 2026 · Direct link

The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The security shortcomings were remedied after the inspections.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data processors

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The clinic’s managing director himself reported that a former employee had copied contact details and patient records of all patients and poached them for a new clinic. In the subsequent investigation, the clinic did not fully answer the requests of the Romanian data protection authority (ANSPDCP) despite a reprimand and an order; the authority therefore imposed 10,190 lei (2,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in February 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Feb 2026

Original amount 10,190 RON, converted at the ECB reference rate of 20 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following the tragedy at the Lapu-Lapu Day festival in 2025, 36 employees of three health authorities accessed patient data of 16 admitted persons without authorisation in 71 instances. Those affected were not informed without undue delay; the Information and Privacy Commissioner for British Columbia (OIPC BC) made nine recommendations, including automated access monitoring and deterrent disciplinary measures.

Authority / court

Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Area of law

Data protection · Data breaches and data security

Legal basis

Freedom of Information and Protection of Privacy Act (FIPPA) BC, s. 25.1

Action

Other

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Appropriate safeguards were in place; the authorities responded quickly and accepted all recommendations.

Published

18 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

A hospital of the group had removed from its archive earlier MRI scans that a patient had brought in for comparison once an internal collection period had expired, so that they were no longer available. The AEPD imposed 100,000 EUR each for processing health data without a legal basis (Art. 9 and Art. 6) and 1,000,000 EUR for lack of data protection by design in the procedure (Art. 25), 1,200,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6, 9, 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Mar 2026

Checked against the official source on 28 Sep 2026 · Direct link

An assessment following several security compromises found that the laboratory company had notified neither the Information Regulator nor the affected data subjects. After an enforcement notice that it failed to comply with, it received an infringement notice with an administrative fine of ZAR 100,000, which has since been paid.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Data breaches and data security

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA), s. 22

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

13 Nov 2025

Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Despite access requests, two patients did not receive copies of their scan files at the end of treatment; the practice responded only sluggishly to enquiries and did not attend an appointment with the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered disclosure under Art. 15(3) GDPR or a reasoned refusal and threatened a penalty payment of 2,000 EUR.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. c, Art. 12 Abs. 4, Art. 15 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

On the application of the Australian Information Commissioner, the Federal Court of Australia imposed the first civil penalties under the Privacy Act 1988: Australian Clinical Labs (ACL) had failed to adequately protect the personal information held on the IT systems of its Medlab Pathology business; in a cyberattack in February 2022, data of more than 223,000 people was taken from those systems. The penalty of 5.8 million AUD in total comprises 4.2 million AUD for the inadequate security measures (APP 11.1), 800,000 AUD because ACL did not assess reasonably and promptly whether a notifiable data breach had occurred, and 800,000 AUD for the late notification to the Commissioner. ACL admitted the contraventions; liability and the penalty were allegedly based on joint submissions by the parties.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act 1988 (Cth) s 13G(a) i. V. m. APP 11.1; s 26WH(2); s 26WK(2)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

Cooperation with the investigation, an ongoing programme to uplift cyber security, apologies and admission of liability.

Liability of senior managers

The court found that the most senior management was involved in the decisions on integrating the Medlab systems and on assessing the attack.

Published

9 Oct 2025

Original amount 5,800,000 AUD, converted at the ECB reference rate of 8 Oct 2025.

Checked against the official source on 3 Oct 2026 · Direct link

For almost six years, the chair of the management board of the medical company was also its data protection officer; this came to light after a report that a patient had been handed documents relating to another person. Poland’s data protection authority (UODO) found a conflict of interest and imposed 11,365 PLN.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 6 DSGVO (DKN.5131.7.2025)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

An independent external data protection officer was appointed in July 2024.

Published

29 Sep 2025

Original amount 11,365 PLN, converted at the ECB reference rate of 12 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

From April to September 2023, attackers used reused credentials to access data on 155,592 people in the United Kingdom, including ancestry, family trees and health information. There was no MFA, no secure password rules and no effective monitoring; despite anomalies in July 2023, the full investigation only began in October. Joint investigation by the UK Information Commissioner's Office (ICO) with the Privacy Commissioner of Canada.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Employees

250 to 999

Culpability

negligent

Published

17 Jun 2025

Original amount 2,310,000 GBP, converted at the ECB reference rate of 5 Jun 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2018–2022, the online pharmacy transmitted purchase data, including data on prescription medicines, to the tracking providers via Google and Meta tracking. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.1 million EUR and a reprimand; on 1 June 2026 the Helsingin hallinto-oikeus (Helsinki Administrative Court) upheld the infringement but annulled the fine because it was unclear whether a fine may be imposed on the university pharmacy at all (not final).

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio; Helsingin hallinto-oikeus

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 9, Art. 25, Art. 32

Action

Fine

Status of proceedings

overturned

Sector

Healthcare

Published

4 Jun 2025

Amount in EUR; no ECB reference rate is available for this currency.

Checked against the official source on 25 Sep 2026 · Direct link

Despite being asked to do so, a healthcare provider (name redacted) did not correct a patient’s address, so that health reports were sent to third parties, and used address data from the electoral register without a legal basis. The Information and Data Protection Commissioner (IDPC) issued a reprimand, ordered rectification, erasure of the register data and the designation of a data protection officer, and imposed fines of 12,500, 5,000 and 2,500 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und d, Art. 6 Abs. 1, Art. 14, 16, 37 Abs. 1 lit. c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Following a ransomware attack in 2021 – the second after an attack in 2019 – the Litigation Chamber found that a Belgian hospital had, among other things, no data protection impact assessment, no effective information security policy, no adequate procedure for security updates of its software and no genuine training and awareness programme for staff. On 17 December 2024 it imposed a fine of 200,000 EUR, ordered remedial measures and rejected the argument that, as a public body, the hospital could not be fined. On 3 September 2025 the Market Court partially annulled the decision and reduced the fine to 50,000 EUR; the data protection authority has lodged an appeal in cassation against that judgment. The decision is not final. The amount and the facts have not been confirmed against the primary source.

Authority / court

Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 24, Art. 32 und Art. 35 Abs. 3 DSGVO; Art. 58 Abs. 2 lit. d und i sowie Art. 83 DSGVO; Art. 100 § 1 9° und 13° sowie Art. 101 LCA

Action

Fine

Status of proceedings

reduced

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The Chamber reduced the starting amount of 390,000 EUR to 200,000 EUR, mainly because of the hospital's financial difficulties, the Covid-19 crisis as a mitigating circumstance and a reassessed duration of the infringement.

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

The ICO issued a reprimand to United Lincolnshire Teaching Hospitals NHS Trust. The ICO found that between March 2021 and March 2022 the trust failed to answer 32% of subject access requests within the one-month statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Employees

1,000 to 9,999

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link