CNIL (France) - SAN-2026-008
CNIL fines healthcare data controller €5M for GDPR breaches in EMR and pharmacy repositories.
France's CNIL (Data Protection Authority) issued a €5 million fine against a healthcare data controller for multiple GDPR and French Data Protection Act violations. Violations included failing to provide accurate information notices to patients in the EMR repository, not ensuring patients' right to object, failing to inform pharmacy patients about data transfers (Article 14 GDPR breach), conducting unauthorised studies on health data, and implementing insufficient data protection by design in pharmacy software that systematically extracted patient data without consent.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CNIL (Commission Nationale de l'Informatique et des Libertés)?
Get an email when a new story names CNIL (Commission Nationale de l'Informatique et des Libertés), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA French healthcare organization systematically violated GDPR requirements by failing to implement proper consent mechanisms and data protection by design principles. The violations included inadequate patient notification about data processing, unauthorized health data studies, and pharmacy software that automatically extracted patient data without consent. This case demonstrates how technical design flaws combined with poor privacy governance can lead to massive regulatory penalties and patient trust erosion.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.