The Netherlands

Orthodontic Clinic

12,000 €

GDPR enforcement action by Dutch Supervisory Authority for Data Protection (AP) on 2021-02-04.

Rank · Sector

#123

of 270 in Health Care

Rank · The Netherlands

#41

of 43

Rank · All fines

#1,261

of 3,042

Case details

Authority: Dutch Supervisory Authority for Data Protection (AP)
Date: 2021-02-04
Controller / Processor: Orthodontic Clinic
Sector: Health Care
Quoted Articles: Art. 32 (1) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Dutch DPA (AP) has fined an orthodontic clinic EUR 12,000. The web form that new patients used to sign up contained mandatory fields for all sorts of patient personal data. The data that the patients (mostly children) entered into the form was then sent to the orthodontic clinic via an unencrypted - and thus unsecured - connection. This presented the risk of unauthorized third parties accessing the personal data of the data subjects.

Open original source Links to the regulator's original publication or another source.