Romanian DPA Fines Dental Clinic for Unlawful Data Processing and Non-Cooperation
Written by AI from the linked story. Not reviewed by an editor. How this works
HAYAT MEDICAL and DENTAL S.R.L. was fined for processing patients' personal data — including names and phone numbers — without a valid legal basis, a fundamental requirement under GDPR. Healthcare providers handle sensitive personal data and must establish and document a lawful basis for every processing activity before it begins. Compounding the violation, the clinic failed to cooperate with the DPA's investigation by withholding requested information, which regulators treat as an aggravating factor. This case demonstrates that non-compliance penalties extend beyond the original data misuse — obstruction or lack of transparency with supervisory authorities carries its own significant risk. Healthcare organizations of all sizes must treat data governance and regulatory responsiveness as core operational responsibilities.
Tactical Insight
Immediate actions
- Conduct a data mapping exercise to identify all personal data being processed and document the lawful basis for each processing activity under GDPR Article 6.
- Establish a written procedure for responding to DPA inquiries, designating a responsible contact and mandating full cooperation within regulatory deadlines.
Long-term improvements
- Implement a formal Records of Processing Activities (RoPA) register as required by GDPR Article 30, reviewed and updated at least annually.
- Appoint or engage a Data Protection Officer (DPO) or privacy counsel familiar with healthcare data regulations to oversee ongoing compliance.
- Develop staff training programmes specifically covering lawful bases for processing, patient consent, and obligations when regulators make information requests.
Detection and governance measures
- Schedule periodic internal audits of data processing activities to identify any operations lacking documented legal justification before regulators do.
- Create an escalation and incident response path specifically for regulatory inquiries, ensuring legal and management teams are involved from first contact.