Company – €500,000 Fine (Germany, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A healthcare company in Hamburg was fined for sending doctors' letters to the wrong person due to inadequate data security measures. The letters contained sensitive health information and were repeatedly sent to an unauthorized recipient. This case emphasizes the need for strong data protection practices in handling sensitive information.
What happened
A healthcare company sent doctors' letters to the wrong person due to insufficient data security measures.
Who was affected
Patients whose sensitive health information was sent to an unauthorized recipient.
What the authority found
The data protection authority fined the company for failing to implement adequate security measures to protect sensitive health data, violating GDPR.
Why this matters
This case highlights the critical importance of robust data security measures, especially when handling sensitive health information. It serves as a reminder that companies must ensure their systems prevent unauthorized access to personal data.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The DPA of Hamburg has imposed a fine in the six-digit range on a Hamburg-based company operating in the healthcare sector. The company had failed to take appropriate technical and organizational measures to ensure a level of data security protection appropriate to the risk when sending doctors' letters. As a result, doctor's letters were to a person who, although practicing a medical profession, was not the doctor providing further treatment for the affected patients. Instead, the letters were intended for a general practitioner with the same name as the recipient. The company had been informed of the incorrect mailing several times in the past by the unauthorized recipient. Nevertheless, it had failed to take organizational and technical measures to ensure that these incidents would not recur. In assessing the fine, the DPA took into aggravating account the fact that the data processed involved health data and that such data is particularly sensitive.
Related Enforcement Actions (20)
Other enforcement actions involving Company in DE
Fine
€500K
Details
Fine Date
1 January 2021
Authority
Bundesbeauftragter für den Datenschutz
Fine Amount
€500,000
Enforcement Tracker ID
ETid-1282
About this data
Cite as: Cookie Fines. Company - Germany (2021). Retrieved from cookiefines.eu
Last updated: