A clinic was sanctioned for processing patient data without a legal basis and, moreover, for failing to cooperate with the supervisory authority during its investigation.

Facts and context

The National Supervisory Authority for Personal Data Processing (ANSPDCP) today published a sanction decision against S.C. HAYAT MEDICAL & DENTAL S.R.L., including the imposition of a total fine of €5,000, for breaches related to the absence of a legal basis for processing patient data and a failure to cooperate with the authority.

The investigation was initiated following a complaint from a data subject alleging a possible violation of the GDPR provisions.

Grounds for the decision

• Obligation to cooperate with the supervisory authority (Article 58(1)(a) and (e) of the GDPR): The authority found that the controller did not provide all the information requested during the exercise of its investigative powers. This failure to cooperate constitutes a separate infringement, sanctioned under Article 83(5)(e) of the GDPR.
• Obligation of lawfulness, fairness and transparency of processing (Article 5(1)(a) of the GDPR and Article 6(1) of the GDPR): It was established that the company processed personal data of patients, including their first name, last name and phone number, without a valid legal basis. The authority concluded that this access and disclosure of data violated the principle of lawfulness of processing.

Decision of the authority

Consequently, the authority imposed a total fine of 26,750 lei (equivalent to €5,000) on S.C. HAYAT MEDICAL & DENTAL S.R.L., consisting of a fine of 10,700 lei (€2,000) for failure to cooperate and a fine of 16,050 lei (€3,000) for the absence of a legal basis.

Lessons learned

This decision reminds that:

• Failure to cooperate with a supervisory authority, notably by not responding or responding incompletely to its requests for information, constitutes a separate infringement and may be sanctioned independently of other violations found.
• Processing patient data, even if it only concerns identification and contact data, must imperatively be based on a valid legal basis within the meaning of Article 6 of the GDPR.
• The same investigation may result in the imposition of several distinct fines when the breaches found relate to violations of different GDPR provisions, as is the case between a substantive breach (absence of legal basis) and a procedural breach (failure to cooperate).