[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhU89zXESSzcw_0H1VQSmreckuHFYFYVFwMicPpSEJ_8":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":67},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"920848d4-d5f2-45be-9759-a8d12475e616","ANSPDCP (Romania) - Fine against HAYAT MEDICAL and DENTAL S.R.L","anspdcp-romania-fine-against-hayat-medical-and-dental-s-r-l-f34778","← Older revision Revision as of 14:13, 2 November 2026 (2 intermediate revisions by the same user not shown) Line 109: Line 109: === Holding === === Holding === Regarding the controller’s cooperation with the DPA, ANSPDCP held that it failed to provide all the information requested in the exercise of its investigative powers, in breach of [[Article 58 GDPR|Article 58(1)(a) GDPR]] and Article 58(1)€ GDPR, in conjunction with [[Article 83 GDPR|Article 83 GDPR]](5)(e). Regarding the controller’s cooperation with the DPA, ANSPDCP held that it failed to provide all the information requested in the exercise of its investigative powers, in breach of [[Article 58 GDPR|Article 58(1)(a) GDPR]] and [[Article 58 GDPR|Article 58(1)(e) GDPR]], in conjunction with [[Article 83 GDPR|Article 83(5)(e) GDPR]]. Regarding the processing of patients’ personal data, ANSPDCP found that the controller processed the data without a legal basis, including by accessing and disclosing patients’ names and phone numbers. The DPA therefore found a violation of [[Article 5 GDPR|Article 5(1)(a) GDPR]] and [[Article 6 GDPR|Article 6(1) GDPR]]. Regarding the processing of patients’ personal data, ANSPDCP found that the controller processed the data without a legal basis, including by accessing and disclosing patients’ names and phone numbers. The DPA therefore found a violation of [[Article 5 GDPR|Article 5(1)(a) GDPR]] and [[Article 6 GDPR|Article 6(1) GDPR]].","The Romanian Data Protection Authority (ANSPDCP) has fined HAYAT MEDICAL and DENTAL S.R.L. a total of RON 26,750 (approximately €5,000). The fine was issued for two main violations: unlawfully processing patients' personal data, including names and phone numbers, without a legal basis, and failing to cooperate fully with the DPA's investigation by not providing requested information. This case underscores the importance of proper data handling and cooperation with regulatory bodies for healthcare providers.","Romania's ANSPDCP fines HAYAT MEDICAL and DENTAL S.R.L €5,000 for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_Fine_against_HAYAT_MEDICAL_and_DENTAL_S.R.L&diff=53573&oldid=53570","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-11-02T14:13:14+00:00","2026-11-02T15:00:29.972408+00:00",7,[17,20],{"name":18,"type":19},"HAYAT MEDICAL and DENTAL S.R.L","vendor",{"name":21,"type":19},"ANSPDCP","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,33,38,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":66},[49],{"slug":50,"name":51,"problem":52,"products":53},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[54,60],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":55,"product_name":56,"url":58,"description":59},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":61,"product_name":62,"url":64,"description":65},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":68,"title":69,"body":70,"framework_refs":71,"framework_notes":79},"romanian-dpa-fines-dental-clinic-for-unlawful-data-processing-and-non-cooperation","Romanian DPA Fines Dental Clinic for Unlawful Data Processing and Non-Cooperation","HAYAT MEDICAL and DENTAL S.R.L. was fined for processing patients' personal data — including names and phone numbers — without a valid legal basis, a fundamental requirement under GDPR. Healthcare providers handle sensitive personal data and must establish and document a lawful basis for every processing activity before it begins. Compounding the violation, the clinic failed to cooperate with the DPA's investigation by withholding requested information, which regulators treat as an aggravating factor. This case demonstrates that non-compliance penalties extend beyond the original data misuse — obstruction or lack of transparency with supervisory authorities carries its own significant risk. Healthcare organizations of all sizes must treat data governance and regulatory responsiveness as core operational responsibilities.",[72,73,74,75,76,77,78],"GDPR Article 32","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"GDPR Article 32":80,"NIST SP 800-53 SI-2: Flaw Remediation":81,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":82,"CIS Control 17: Incident Response Management":83,"CIS Control 14: Security Awareness and Skills Training":84,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":85,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":86},"Article 32 requires appropriate technical and organisational measures to ensure data security; the clinic's failure to establish lawful processing bases reflects a breakdown in the organisational measures needed to protect patient data.","While SI-2 addresses technical flaws, its underlying principle of identifying and correcting compliance gaps on a structured schedule applies to identifying processing activities lacking a lawful basis before regulators intervene.","Clause 7.2 requires organisations to ensure personnel have the competence to fulfil their information security and compliance obligations; inadequate staff knowledge of GDPR lawful bases contributed to unlawful processing.","A defined process for responding to regulatory investigations — treated similarly to an incident — would have ensured timely, complete cooperation with the DPA instead of the obstruction that aggravated the penalty.","A structured training programme covering data privacy regulations would have equipped staff to recognise when processing activities require a documented legal basis, preventing the core violation.","Broader vulnerability management principles — including regular review of organisational and procedural gaps — would have surfaced the absence of lawful processing documentation as a compliance risk requiring remediation.","Controlling who can access and process personal data, and under what authority, directly addresses the absence of a legal basis for processing that triggered this fine."]