Unencrypted transmission of health data

The Spanish supervisory authority Agencia española protección datos (AEPD) imposed several fines on a pharmacy in Catalonia.

The pharmacy had accessed the health data of nursing home residents without legal basis, passed it on via unsecure channels by unencrypted email, taken insufficient security measures and failed to inform the individuals concerned about the processing beforehand. The 18 published penalty notices therefore resulted in numerous fines ranging from €6,600 to €21,000, some of which were reduced after voluntary payment and acknowledgment of liability.

This case shows how important it is to use secure transmission channels when sending sensitive health data. When sending emails in particular, care must be taken to ensure that unauthorized third parties cannot access this data and that the emails are encrypted during transmission. However, since the individuals concerned were not even informed about the transmission and there was no effective legal basis for it, the violations were particularly serious.