ANSPDCP (Romania) - Fine against Societatea Civilă Medicală Policlinica Tommed
|ANSPDCP (Romania) - Fine against Societatea Civilă Medicală Policlinica Tommed|
|Relevant Law:||Article 5(1)(a) GDPR|
Article 5(1)(b) GDPR
Article 5(1)(f) GDPR
Article 5(2) GDPR
Article 9 GDPR
|Parties:||Societatea Civilă Medicală Policlinica Tommed|
|National Case Number/Name:||Fine against Societatea Civilă Medicală Policlinica Tommed|
|European Case Law Identifier:||n/a|
|Original Source:||ANSPDCP (in RO)|
|Initial Contributor:||Diana Rosu|
The Romanian DPA fined a medical clinic approximately €2.000 after it unlawfully processed and disclosed a patient's health data to another controller.
English Summary[edit | edit source]
Facts[edit | edit source]
The controller is a medical clinic, the Medical Civil Society Policlinica Tommed. The Romanian DPA started an investigation against the medical clinic after a complaint was filed by one of its patients. During the investigation, the DPA found that the clinic unlawfully disclosed the personal data belonging to a patient, including their health data, to another controller. Moreover, the patient was not informed of this.
Holding[edit | edit source]
First, the DPA held that there was no legal basis to process the sensitive personal data. Moreover, the principle of purpose limitation was also violated. Lastly, the DPA noted that the controller failed to implement appropriate measures to ensure security and confidentiality. The DPA concluded this since there was no regular training of persons that process the data for the controller, nor was the data protection officer properly involved in accordance with Article 37 GDPR, Article 38 GDPR, and Article 39 GDPR.
As result, the DPA imposed a fine of approximately €2.000 (RON9.898) on the controller. Moreover, the DPA applied a corrective measure, ordering the clinic to bring its processing operations into compliance to prevent further unlawful disclosure and to apply adequate security and confidentiality measures.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
06.12.2021 & # 13; RGPD & # 13; & # 13; In November 2021, the National Supervisory Authority completed an investigation at the operator of the Civil Medical Society Tommed Polyclinic, following which it was found that the provisions of art. 5 para. (1) lit. a), b) and f) and par. (2), corroborated with art. 9 of the General Data Protection Regulation. & # 13; As such, the operator was sanctioned with a fine of 9898 lei (equivalent to 2,000 euros). & # 13; The investigation was launched following a complaint alleging that the Tommed Polyclinic Medical Society disclosed certain personal data, including health, of an individual to another operator. & # 13; During the investigation it was found that the controller disclosed the personal data without respecting the principles of processing and without complying with the legal conditions of processing of personal data, including health, and without prior information of the person involved (patient of the operator). & # 13; At the same time, the corrective measure was applied to the operator to ensure the compliance with RGPD of the operations of collection and further processing of personal data, so as to avoid the disclosure of personal data processed, in violation of legal conditions, which also involves the application of appropriate measures. security and confidentiality, through the regular training of data controllers under the authority of the controller and the appropriate involvement of the person responsible for the protection of personal data, in accordance with art. 37-39 of the RGPD. & # 13; Legal and Communication Department & # 13; A.N.S.P.D.C.P.