Centro Hospitalar Barreiro Montijo in Portugal has been fined 400,000 euros for violating the EU General Data Protection Regulation. The country's supervisory authority fined the hospital for failure to ensure the continued confidentiality of data, as well as failure to ensure a level of security adequate the risks of its data processing. The hospital said the Comissão Nacional de Protecção de Dados could not be considered as the supervisory authority as per Article 51 because it had not yet been appointed formally. To this, CNPD responded that it is, for all purposes, the national authority that has the power to control and supervise the compliance in terms of data protection in accordance with the current Portuguese Data Protection Law. Also, among its arguments was that the hospital used the IT system provided to public hospitals by the Portuguese Health Ministry and not its own systems. Ana Menezes Monteiro, CIPP/E, CIPM, CIPT, FIP, has the details for The Privacy Advisor. 
Full Story