Belgium

Hospital

200,000 €

GDPR enforcement action by Belgian Data Protection Authority (APD) on 2024-12-17.

Rank · Sector

#29

of 270 in Health Care

Rank · Belgium

of 50

Rank · All fines

#365

of 3,051

Case details

Authority: Belgian Data Protection Authority (APD)
Date: 2024-12-17
Controller / Processor: Hospital
Sector: Health Care
Quoted Articles: Art. 5 (1) f) GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 (3) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Belgian DPA has fined a hospital EUR 200,000. The hospital had suffered a ransomware attack through a vulnerability in the server, which paralyzed parts of the computer system and affected about 300,000 individuals. During its investigation, the DPA found that the hospital had failed to carry out a data protection impact assessment. In addition, the DPA found that it did not have an adequate information security policy in place and failed to implement appropriate technical and organizational measures to protect personal data in order to prevent such an incident, such as employee training and the implementation of a process for security updates of IT equipment.

Open original source Links to the regulator's original publication or another source.