- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 103/2023 – Complaint Upheld (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian hospital group allowed all its employees to access patient records, even if they didn't work directly with those patients. This raised concerns about privacy and security for patients. The ruling highlights the importance of strict access controls in healthcare settings.
What happened
The Belgian DPA found that a hospital group's internal data access policy violated GDPR requirements.
Who was affected
Patients whose medical records were accessible to employees of the hospital group, regardless of their direct involvement.
What the authority found
The DPA ruled that the hospital group failed to implement appropriate security measures to protect patient data, violating Article 32 and Article 24 of GDPR.
Why this matters
This case emphasizes the need for healthcare providers to limit access to patient data strictly to those who need it. It sets a precedent for stronger data protection measures in healthcare.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Following a sexual assualt, the data subject visited and was treated by Centre 'Z'. Centre 'Z' is a part of the hospital group against which the complaint was filed. Several months later, the data subject visited a psychologist employed by the hospital group who manages Centre 'Z'. However, the psychologist did not work at Centre 'Z' and the visit was unrelated to the data subject's sexual assault. During the psychological consultation, the data subject was asked questions relating to her sexual assault, this indicated to her that the psychologist had access to her medical data held by Centre 'Z', despite not working at Centre 'Z'. The data subject contacted Centre 'Z' regarding their internal data access policy. She was informed that all of the hospital group's employees could access her records, regardless of whether they worked at Centre 'Z' or not. She requested that the Centre restrict access to her data to only staff working at Centre 'Z'. The Centre responded that this was not possible, but did note that the hospital group was in the process of updating its policy on this matter. The Belgian DPA found that the hospital group's internal data security measures were in violation of Article 32 GDPR and Article 24 GDPR. These Articles impose a duty upon controllers and processors to implement the "appropriate technical and organisational measures" to ensure compliance with the GDPR, and to ensure a level of security appropriate to the risk of processing. The Belgian DPA interpretted the meaning of "appropriate technical and organisational measures" in a healthcare context to mean that measures should be implemented to "ensure that healthcare providers and other professionals who use [an] information exchange system only have access to data from a patient file which is necessary for their respective services." In reaching this conclusion, the Belgian DPA explicitly affirmed the position taken by the Committee of Ministers of the Council of Europe in Recomm
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 103/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 103/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: