Nacionaliniam visuomenės sveikatos centrui (NVSC) – €12,000 Fine (Lithuania, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Lithuania's National Health Service was fined for not protecting personal data in a COVID-19 quarantine app. The app collected sensitive information like health data without proper safeguards. This case highlights the importance of data security and transparency in health apps.
What happened
The Lithuanian National Health Service used a quarantine app that collected personal data without adequate protection or transparency.
Who was affected
Individuals who used the quarantine app and had their personal and health data collected.
What the authority found
The Lithuanian DPA found that the National Health Service failed to implement necessary security measures and provide clear information, violating GDPR rules.
Why this matters
This decision underscores the need for health apps to have strong data protection measures and clear privacy policies. Businesses should ensure they conduct data protection impact assessments when handling sensitive data.
GDPR Articles Cited
The Lithuanian DPA (VDAI) imposed a fine of EUR 12,000 on the Lithuanian National Health Service (NVSC). The DPA had opened an investigation regarding a quarantine app introduced in Lithuania during the COVID-19 pandemic in spring 2020. The IT company 'IT sprendimai sėkmei' had developed the app, which was then used by the NVSC. In the course of the investigation, the DPA found that during the app's period of use, the data of a total of 677 individuals had been processed in varying degrees. The app was able to collect data such as the name, address and phone number of the data subjects. The DPA concluded that the controller had not taken sufficient technical and organizational measures to protect the data processing. Furthermore, a data protection impact assessment was not carried out, although this would have been necessary in particular because the app also processed special categories of personal data including health data. The DPA further stated that the controller had provided non-transparent and incorrect information in the app's privacy policy.
Related Enforcement Actions (0)
No other enforcement actions found for Nacionaliniam visuomenės sveikatos centrui (NVSC) in LT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
26 February 2021
Authority
Valstybine duomenu apsaugos inspekcija
Fine Amount
€12,000
Enforcement Tracker ID
ETid-571
About this data
Cite as: Cookie Fines. Nacionaliniam visuomenės sveikatos centrui (NVSC) - Lithuania (2021). Retrieved from cookiefines.eu
Last updated: