The 7th of December 2020, the limited training of the CNIL has issued two sanctions of 3.000 and 6.000 euros against two doctors for having protected in an insufficient way personal data of patiences and for not having notified a data breach to the CNIL. 

After a control online done in September 2019, the CNIL has detected that million of medical images on the servers of two free doctor were freely accessible on internet. 

During the controls, doctors have understood that data breaches came from a bad choice of internet box settings, as well as a bag setting of their software of medical imaging. The investigations have permitted to establish that medical images stored on their server were not systematically encrypted. 

On the basis of these elements, the restricted training, the CNIL body responsible for imposing sanctions, noted that the two doctors had broken with the basic principles of computer security. It found that they had failed to comply with the obligation of data security (Article 32 of the GDPR), considering that they should have ensured that the configuration of their computer networks did not lead to data being freely accessible on the Internet and that they had systematically encrypted the personal data hosted on their servers.

The restricted training also included a failure to comply with the obligation to notify data breaches to the CNIL (Article 33 of the GDPR). Indeed, the two doctors did not carry out these mandatory notifications which they should have done after learning that their patients’ medical images were freely accessible on the Internet.

Although the restricted training did not consider it necessary for the identity of the doctors concerned to be made public, it nevertheless wished to ensure that these decisions were published in order to alert health professionals to their obligations and the need to increase their vigilance with regard to the security measures applied to the personal data they process.

This vigilance should lead them to choose application solutions offering the maximum guarantees in terms of IT security and personal data protection. It should also encourage them to be cautious when designing and configuring their internal IT system, if necessary by working with competent service providers in this area.

SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA FRANCIA – CNIL