Sanction RGPD Belgian Data Protection Authority (APD) — Hospital : 200 k€ (2024)
- Autorité de contrôle
- Belgian Data Protection Authority (APD)
- Pays
- Belgique
- Entreprise / secteur
- Hospital
- Montant de l'amende
- 200 k€
- Date de la décision
- 17 décembre 2024
- Fondement juridique
- Art. 5 (1) f), Art. 24, Art. 32, Art. 35 (3)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Belgian DPA has fined a hospital EUR 200,000. The hospital had suffered a ransomware attack through a vulnerability in the server, which paralyzed parts of the computer system and affected about 300,000 individuals. During its investigation, the DPA found that the hospital had failed to carry out a data protection impact assessment. In addition, the DPA found that it did not have an adequate information security policy in place and failed to implement appropriate technical and organizational measures to protect personal data in order to prevent such an incident, such as employee training and the implementation of a process for security updates of IT equipment.