A hospital became one of the first organisations to face GDPR
enforcement in Portugal in July 2018. The hospital received a
€400,000 fine from the Portuguese regulator, Comissão
Nacional de Protecção de Dados ("CNPD") for
various breaches of the GDPR.
The hospital was fined for the following three violations of the
GDPR:
- Breach of the data minimisation
principle;
- Breach of the integrity and
confidentiality principle; and
- The failure to ensure the ongoing
security of processing under Article 32 of the GDPR.
For breaches of the data protection principles, a maximum fine
of €20,000,000 or 4% of global turnover, whichever is higher,
may be imposed. However, the maximum fine for the third violation
is €10,000,000 or 2% of global turnover, whichever is
higher.
