Heilsugæsla höfuðborgarsvæðisins (HH), an institution which operates 15 health care centres in the Reykjavik area in Iceland, has been fined IKr 5m ($35,844) by Personuvernd, the Icelandic Data Protection Authority, after processing personal data unlawfully. The institution manages a joint medical record system containing thousands of individuals’ data, and approximately 450,000 medical records.
The institution, also known as Primary Health Care of the Capital Area, entered agreements with multiple parties regarding a joint medical record system and/or to authorize access to the institution’s medical record system.
However, after investigating how HH processed the data of multiple organizations, the Icelandic DPA found that it could not “demonstrate that the personal data processing had been authorized.” The conditions of the Medical Register Act had also not been observed.
Even though the institution had entered into agreement with organizations about how to process data, and the Ministry of Welfare had granted permission to merge one of the health record systems with HH, the overall agreements did not align, and there were no permissions from the Ministry of Welfare and the Icelandic DPA to merge the health records. This resulted in multiple violations of both EU GDPR and the Medical Register Act. Therefore, HH was issued the IKr 5m ($35,844) fine.
The organizations affected by the unlawful data processing were:
- the Reykjavík Homecare Centre;
- the Höfði Health Centre;
- the Salahverfi Health Centre;
- the Urðarhverfi Health Centre;
- the Football Association of Iceland;
- the Medical Center for Air;
- the Transportation Office;
- Janus rehabilitation ehf.;
- the Höfði Health Centre in Suðurnes;
- the Welfare Department of the City of Reykjavík; and
- the Directorate of Labour.
Primary Health Care of the Capital Area operates 15 health care centres in Reykjavík, Seltjarnarnes, Mosfellsbær, Kópavogur, Garðabær, and Hafnarfjörður, where it provides coordinated services. It also has five mental health teams, and oversees specialised care service centres.
