- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Company – €500,000 Fine (Germany, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A healthcare company in Hamburg was fined for not securing patient data properly when sending doctors' letters. This is significant because it shows that companies must take strong measures to protect sensitive health information to avoid serious penalties.
What happened
The healthcare company failed to secure doctors' letters, which were mistakenly sent to the wrong recipient.
Who was affected
Patients whose sensitive health information was included in the incorrectly sent letters were affected.
What the authority found
The DPA ruled that the company did not take adequate steps to protect personal data, violating GDPR's requirements for data security.
Why this matters
This case emphasizes the need for healthcare providers to implement robust data protection measures, especially when handling sensitive information, to avoid costly fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
Processing notes: authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA of Hamburg has imposed a fine in the six-digit range on a Hamburg-based company operating in the healthcare sector. The company had failed to take appropriate technical and organizational measures to ensure a level of data security protection appropriate to the risk when sending doctors' letters. As a result, doctor's letters were to a person who, although practicing a medical profession, was not the doctor providing further treatment for the affected patients. Instead, the letters were intended for a general practitioner with the same name as the recipient. The company had been informed of the incorrect mailing several times in the past by the unauthorized recipient. Nevertheless, it had failed to take organizational and technical measures to ensure that these incidents would not recur. In assessing the fine, the DPA took into aggravating account the fact that the data processed involved health data and that such data is particularly sensitive.
Related Enforcement Actions (6)
Other enforcement actions involving Company in DE
Fine
€500K
Details
Fine Date
1 January 2021
Authority
Bundesbeauftragter für den Datenschutz
Fine Amount
€500,000
Enforcement Tracker ID
ETid-1282
About this data
Cite as: Cookie Fines. Company - Germany (2021). Retrieved from cookiefines.eu
Last updated: