- Enforcing jurisdiction
- Portugal · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Public Hospital – €400,000 Fine (Portugal, 2018)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A public hospital in Portugal was fined €400,000 for allowing staff to access patient data through fake profiles. This matters because it shows that hospitals must protect sensitive patient information and have proper access controls in place.
What happened
The hospital's staff accessed patient data using false profiles due to a poor profile management system.
Who was affected
Patients whose data was accessed by unauthorized hospital staff.
What the authority found
The authority found that the hospital failed to implement adequate security measures to protect patient data.
Why this matters
This case highlights the importance of strong data protection practices in healthcare settings. Hospitals and similar organizations should regularly review their access controls to prevent unauthorized data access.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 6 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Investigation revealed that the hospital’s staff, psychologists, dietitians and other professionals had access to patient data through false profiles. The profile management system appeared deficient – the hospital had 985 registered doctor profiles while only having 296 doctors. Moreover, doctors had unrestricted access to all patient files, regardless of the doctor’s specialty.
Related Enforcement Actions (0)
No other enforcement actions found for Public Hospital in PT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
17 July 2018
Authority
Comissão Nacional de Proteção de Dados
Fine Amount
€400,000
Enforcement Tracker ID
ETid-45
About this data
Cite as: Cookie Fines. Public Hospital - Portugal (2018). Retrieved from cookiefines.eu
Last updated: