ANSPDCP (Romania) - Fine against HAYAT MEDICAL and DENTAL S.R.L

HAYAT MEDICAL and DENTAL S.R.L. was fined for processing patients' personal data — including names and phone numbers — without a valid legal basis, a fundamental requirement under GDPR. Healthcare providers handle sensitive personal data and must establish and document a lawful basis for every processing activity before it begins. Compounding the violation, the clinic failed to cooperate with the DPA's investigation by withholding requested information, which regulators treat as an aggravating factor. This case demonstrates that non-compliance penalties extend beyond the original data misuse — obstruction or lack of transparency with supervisory authorities carries its own significant risk. Healthcare organizations of all sizes must treat data governance and regulatory responsiveness as core operational responsibilities.