Enforcing jurisdiction
Spain · Geography does not establish applicable law.
Confirmed applicable legislation

Hospital Campogrande DE – €10,000 Fine (Spain, 2021)

€10,000Agencia Española de Protección de Datos10 March 2021Spain
final
Fine

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

Hospital Campogrande DE was fined EUR 10,000 for improperly linking a patient's medical records. This decision is important because it shows that hospitals must handle patient data carefully.

What happened

The hospital linked a patient's MRI results without proper medical justification.

Who was affected

The patient who underwent the MRI was affected by this improper linking of records.

What the authority found

The authority ruled that the hospital's actions violated data protection rules by sharing information without justification.

Why this matters

This ruling serves as a warning to healthcare providers about the importance of protecting patient information. Hospitals must ensure they have valid reasons for sharing or linking patient data.

Recorded legal citations
Automatically processed
Art. 5(1)(f) GDPR
View original scraped data
Art. 5(1) f) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Linked-source text retrieved.

Review needed — 14 March 2026.

Processing notes: date discrepancy.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

The Spanish DPA (AEPD) imposed a fine of EUR 10,000 on Hospital Campogrande DE. A patient filed a complaint against the controller with the DPA. The controller had performed an MRI on the patient on September 05, 2019 due to an injury of the right knee. The cost of the examination was covered by the patient's private health insurance. Due to a work-related injury, another MRI of the same knee had to be performed on September 27, 2019. Although the second MRI was performed at another hospital, albeit one belonging to the corporate group, the hospital system also linked the first, privately arranged MRI to the patient's record at the second hospital. The first MRI was provided through the hospital network without any medical justification. This turned out to be very unfavorable for the patient when, upon presentation of the second MRI, the company physician informed him that he would have to contact his private physician or the social insurance with this injury, since the incident could not be considered an occupational accident. He justified this with the existence of the first MRI, which had a non-occupational cause.

Related Enforcement Actions (0)

No other enforcement actions found for Hospital Campogrande DE in ES

This is the only recorded action for this entity in this jurisdiction.

Details

Fine Date

10 March 2021

Authority

Agencia Española de Protección de Datos

Fine Amount

€10,000

About this data

Data: CMS GDPR Enforcement Tracker
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Hospital Campogrande DE - Spain (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: