- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
The Danish Health Data Authority – Violation Found (Denmark, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Danish Health Data Authority faced scrutiny for a technical error that affected patient medication records. They failed to report the issue promptly, which raised concerns about data security. This incident underscores the need for robust data management practices.
What happened
A technical error led to incorrect medication information for 267 patients, and the authority reported the issue late.
Who was affected
267 patients whose medication records were affected were impacted.
What the authority found
The Danish Data Protection Authority found that the Health Data Authority did not take adequate security measures to protect personal data.
Why this matters
This case serves as a reminder for organizations to implement strong data security protocols and to report issues quickly to prevent further risks to individuals' data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Danish Health Data Authority (Sundhedsdatastyrelsen) is a controller for the Shared Medication Record (Fælles Medicinkort (FMK)), a national register that shares citizens' medication information across the healthcare system. The FMK is integrated with the healthcare professionals' local systems so they can see which medicine is registered for patients. Doctors can also add, change and remove drug prescriptions in the FMK via their local systems. A technical error occurred on one of the local systems which led to unintended changes in the FMK. The error meant that the removal of the dosage end date for 267 patients on the FMK did not make it through to the local system. The Health Data Authority became aware of the breach on 9 August 2021 but only reported it to the Danish Data Protection Authority (Datatilsynet) on 13 August 2021. The DPA held that under Article 32(1) GDPR, the controller has a duty to identify the data processing risks to the data subjects and implement appropriate security measures to protect them against those risks. Adequate security will typically imply that all probable error scenarios should be tested in connection with developing and modifying software where personal data is processed. In cases where third parties can make changes, the controller is also responsible for testing changes made by others. The DPA held that there must be clearly agreed control mechanisms in place between all actors in a service-based architecture, which would ensure that the controllers can ensure that misunderstandings in data formats or service structure do not result in loss or corruption of the integrity of the data. Consequently, the DPA held that by not testing the Shared Medication Record for integrity errors, the Danish Health Data Authority did not take appropriate technical and organizational measures to ensure security appropriate to the risks involved in the personal data processing. Additionally, the DPA held that the controller violated Articl
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for The Danish Health Data Authority in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. The Danish Health Data Authority - Denmark (2022). Retrieved from cookiefines.eu
Last updated: