Persónuvernd (Island) - 2025051308
Icelandic DPA reprimands hospital employee for unauthorized medical record access.
Iceland's Data Protection Authority (Persónuvernd) has issued a reprimand to a Landspítali Hospital employee for conducting unauthorized searches of a patient's medical records. The employee accessed the records nine times without a legitimate medical treatment basis, violating Articles 6(1) and 9 of the GDPR. The DPA emphasized that while the hospital is the data controller, individual employees are personally responsible for exceeding their access rights.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Landspítali Hospital?
Get an email when a new story names Landspítali Hospital, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Landspítali Hospital employee accessed a patient's medical records nine times without a legitimate clinical justification, violating GDPR Articles 6(1) and 9, which govern lawful basis and special category data processing. The incident highlights that role-based access alone is insufficient — employees must only access records they have an active treatment reason to view. Iceland's DPA reinforced that individual staff members bear personal legal responsibility for exceeding their authorized access scope, not just the organization. This case underscores the critical need for audit logging and proactive access monitoring in healthcare environments to detect anomalous record-viewing behavior before it becomes a formal breach.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.