- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
St. Olavs Hospital – €65,250 Fine (Norway, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
St. Olav's Hospital in Norway was fined EUR 65,250 for three long-term data breaches that exposed sensitive patient information. This is important because it highlights the need for hospitals to maintain strict data security practices.
What happened
St. Olav's Hospital was fined EUR 65,250 for failing to protect personal data, resulting in three significant data breaches.
Who was affected
Patients whose sensitive health data, including names and health metrics, were compromised were affected.
What the authority found
The Norwegian data protection authority ruled that the hospital did not follow proper security protocols, violating GDPR requirements.
Why this matters
This ruling serves as a reminder for healthcare providers to strengthen their data protection measures. Organizations must ensure compliance to safeguard patient information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 12 March 2026.
Processing notes: amount discrepancy, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A Norwegian hospital notified the DPA of three personal data breaches lasting between two and nine years. The breaches found their origin in deficient internal systems upgrades, poorly managed access controls, routines not being followed, and lack of data deletion. The concerned personal data included names, social security numbers, health metrics data, sensitive health data (including information on substance abuse, or health data relating to children), and passwords stored in clear text in an unprotected server. These breaches were discovered during an audit by the Norwegian Office of the Auditor General. A significant number of patients were affected (e.g. about 21,000 records containing sensitive health data in one breach alone). However, the hospital did not have a comprehensive log, making it impossible to fully determine the extent of each breach. The DPA fined the hospital €76,870 (NOK 750,000) for breaching the requirements of internal control, security and safety for the processing of personal data under Article 32 GDPR, Article 24, [https://gdprhub.eu/index.php?title=Article_5_GDPR#1f Article 5(1)(f)] and [https://gdprhub.eu/index.php?title=Article_5_GDPR#2 Article 5(2)], as well as § 26(1) of the [https://lovdata.no/dokument/NL/lov/2018-06-15-38/ Personal Data Act] and §§ 22 and 23 of the [https://lovdata.no/dokument/NL/lov/2014-06-20-42 Health Records Act] (pasientjournalloven) . The DPA also pointed out that the highest-level management position, on behalf of the hospital, is accountable for the (negligent) violation.
Related Enforcement Actions (0)
No other enforcement actions found for St. Olavs Hospital in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
20 September 2021
Authority
Datatilsynet (Norway)
Fine Amount
€65,250
750,000 NOK
GDPRhub ID
gdprhub-4250About this data
Cite as: Cookie Fines. St. Olavs Hospital - Norway (2021). Retrieved from cookiefines.eu
Last updated: