CNIL (the French DPA) fined a doctor EUR 6,000 for violating Art. 32 and Art. 33 of the GDPR. The doctor had stored personal data of his patients on a specific server to access from his home computer. This data includes MRI, X-ray images, names, dates of birth, and other treatment data on various patients. However, CNIL found that the responsible person’s systems were vulnerable to external access, due to inadequate security measures. Anyone could access the patients’ data in this way. This data leak had apparently existed for five years. Therefore, the CNIL found that the doctor had failed to establish adequate security and organizational measures that would ensure data security of his patients.
cnil the french dpa  a doctor  for violating  and  of the  the doctor had stored personal data of his patients on a specific server to access from his home computer this data includes mri xray images names dates of birth and other treatment data on various patients however cnil found that the responsible person’s systems were vulnerable to external access due to inadequate security measures anyone could access the patients’ data in this way this data leak had apparently existed for five years therefore the cnil found that the doctor had failed to establish adequate security and organizational measures that would ensure data security of his patients
cnil  french dpa   doctor   violate        doctor  store personal data   patients   specific server  access   home computer  data include mri xray image name date  birth   treatment data  various patients however cnil find   responsible person’ systems  vulnerable  external access due  inadequate security measure anyone could access  patients’ data   way  data leak  apparently exist  five years therefore  cnil find   doctor  fail  establish adequate security  organizational measure  would ensure data security   patients