- Enforcing jurisdiction
- Netherlands · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
OLVG – €440,000 Fine (Netherlands, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Dutch data protection authority fined the Amsterdam hospital OLVG EUR 440,000 for not keeping patient records secure. Unauthorized employees could access sensitive medical information, which is a serious privacy concern. This case highlights the importance of strong security measures in healthcare.
What happened
OLVG failed to prevent unauthorized access to medical records between 2018 and 2020.
Who was affected
Patients whose medical records were accessible to unauthorized employees were affected.
What the authority found
The authority found that OLVG did not take adequate measures to protect personal data, violating GDPR's security requirements.
Why this matters
This ruling emphasizes that healthcare providers must implement strict security protocols to protect patient information. Other hospitals should review their data access policies to avoid similar penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Dutch DPA (AP) imposed a fine of EUR 440,000 on the Amsterdam hospital OLVG. The controller had taken insufficient measures between 2018 and 2020 to prevent access by unauthorized employees to medical records. The controller did not check adequately who had access to which file nor did the controller ensure that the computer system presented sufficient security. This resulted, among others, in working students and other employees being able to access patient files without this being necessary for their work. Besides medical records, the patient files also contained, the social security numbers, addresses and telephone numbers of the data subjects.
Related Enforcement Actions (1)
Other enforcement actions involving OLVG in NL
Details
Fine Date
11 February 2021
Authority
Autoriteit Persoonsgegevens
Fine Amount
€440,000
Enforcement Tracker ID
ETid-555
About this data
Cite as: Cookie Fines. OLVG - Netherlands (2021). Retrieved from cookiefines.eu
Last updated: