VDAI (Lithuania) - 3R-1143

A Lithuanian medical company failed to implement adequate technical and organizational safeguards, leaving sensitive health data of nearly 383,000 individuals exposed due to weak password policies and the absence of multi-factor authentication. Under GDPR Article 32, organizations processing sensitive personal data — especially health records — are legally obligated to apply appropriate security measures proportionate to the risk. The lack of basic access control hygiene demonstrates that compliance is not merely a checkbox exercise but requires continuous, enforceable security standards. This case highlights how foundational security failures in healthcare environments can result in both massive regulatory penalties and profound harm to data subjects whose most sensitive information is compromised.