The Spanish data protection authority has sanctioned the regional health service of Asturias for maintaining a health data processing process on paper and unsecured email, despite the availability of adequate electronic systems, and for failing to carry out a data protection impact assessment for this high-risk processing.

Facts and context

The Spanish data protection authority (AEPD) has today published a sanction decision against the Health Service of the Principality of Asturias (SESPA) for breaches related to processing security and the absence of a data protection impact assessment.

The case originated from a complaint filed in May 2024, denouncing the management methods of individualized medical treatment authorization requests, which involved the circulation of detailed clinical reports on paper and by email.

Grounds for the decision

• Obligation to ensure the security of processing (Article 32 of the GDPR): The authority found that although SESPA has an electronic medical record system and a secure file sharing platform, the authorization process for individualized treatments still relied on the transmission of clinical reports in paper format. These documents, containing sensitive health data, were transmitted between different services before being digitized and sent by email, without pseudonymization. The authority deemed these measures insufficient to guarantee an appropriate level of security relative to the risk, highlighting that incidents such as the loss or misplacement of requests (among the 1,755 processed in 2023) demonstrated the ineffectiveness of the measures in place. Referring to the Court of Justice of the European Union ruling C-340/21, the authority recalled that the adoption of security measures must be effective and concretely ensure that data are neither lost nor accessible to unauthorized persons.
• Obligation to carry out a data protection impact assessment (Article 35 of the GDPR): The authority considered that the processing of health data for the evaluation of individualized treatments constituted high-risk processing for the rights and freedoms of individuals, notably due to the sensitive nature of the data and the volume processed, which made the carrying out of an impact assessment mandatory. SESPA justified the absence of this assessment by relying on a risk evaluation concluding a low risk level. However, the AEPD rejected this argument, judging the risk analysis provided as fundamentally flawed because it omitted to take into account the special category of data processed (health data), a crucial element in assessing the risk level. The authority recalled, relying on Recitals 84 and 90 of the GDPR, that this analysis must be conducted before the start of processing to assess the severity of the risk and define measures to address it.

Authority's decision

Consequently, the authority declared that the Health Service of the Principality of Asturias violated Articles 32 and 35 of the GDPR.

Furthermore, the authority ordered SESPA to implement, within three months, appropriate technical and organizational measures to secure the processing and to carry out the required data protection impact assessment.

Lessons learned

This decision reminds that:

• The mere existence of secure information systems is not sufficient to guarantee compliance; the controller must ensure that operational processes in place effectively use these systems and that unsecured data flows, notably on paper, are eliminated.
• A risk analysis serving as a basis to decide not to conduct an impact assessment must imperatively and explicitly take into account the nature and sensitivity of the data processed. Omitting to consider that these are health data invalidates the conclusion of the analysis.
• The materialization of risks, such as the loss or misplacement of documents, constitutes tangible proof of the inadequacy of the security measures implemented by the controller.