- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 209/2025 – Complaint Upheld (Belgium, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian hospital received a reprimand for failing to protect the privacy of a pregnant woman and her unborn child. A physiotherapist accessed their medical records without authorization. This case highlights the need for healthcare providers to secure sensitive information properly.
What happened
A physiotherapist accessed a pregnant woman's medical records without permission, revealing private information about her unborn child.
Who was affected
The pregnant woman and her unborn child whose medical records were accessed unlawfully.
What the authority found
The authority found that the hospital did not implement adequate security measures to protect personal data, leading to unauthorized access.
Why this matters
This ruling emphasizes the importance of data security in healthcare settings. Hospitals and clinics must ensure strict access controls to protect patient information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A private text conversation between a pregnant woman (the data subject) and her physiotherapist revealed the sex of the data subject’s unborn child. The data subject intended on waiting until the birth of the child to find out this information. The data subject submitted an access request to the hospital where the pregnancy tests had been performed. The request revealed that the physiotherapist accessed the electronic health record (EHR) of the data subject and her unborn child three times. The data subject and the child’s father, representing the interests of the child, filed a complaint with the Belgian DPA. Firstly, the DPA concluded that in this case, for unauthorised access to the data of an unborn child later on born alive and viable, the protection offered by the GDPR in the context of Belgian law covers the personal data of the unborn child. Secondly, the DPA found that the physiotherapist exceeded the authority entrusted by the hospital and was identified as solely responsible for the unlawful consultation of the pregnancy test results. However, the DPA noted that the hospital was responsible, among other things, for managing access to the EHR software and for the security of the data contained. The DPA found that the hospital violated Article 5(1)(f) GDPR, Article 5(2) GDPR, Article 24 GDPR and Article 32 GDPR by failing to implement sufficient measures to manage access to the unborn child's and the data subject’s EHR, thus not demonstrating compliance with the GDPR. Therefore, the DPA issued a reprimand to the hospital for its violation of Article 5(1)(f) GDPR, Article 5(2) GDPR, Article 24 GDPR, and Article 32 GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 209/2025 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 209/2025 - Belgium (2025). Retrieved from cookiefines.eu
Last updated: