26.10.2018 | KPMG Law Insights

DSGVO fine imposed

GDPR: Portuguese supervisory authority imposes fine of EUR 400,000 on hospital

The Portuguese data protection supervisory authority has imposed a fine of EUR 400,000 on a hospital. This is – at least as far as is known – the first significant fine across Europe following the entry into force of the General Data Protection Regulation (GDPR) on May 25, 2018.


The Portuguese data protection authority CNPD (Comissão Nacional de Protecção de Dados) has announced that a large part of the fine was based on the fact that too many people had access to patient data at the hospital concerned. For example, data that was supposed to be accessible only to physicians could also be accessed by technicians. In addition, nearly 1,000 users were registered in the system as “doctors,” although the hospital actually employed just under 300 physicians.

Legal classification

Personal data must be protected – and not just since the DSGVO came into force – in such a way that only those employees have access who actually have to work with precisely this data and therefore need access. This principle is now also explicitly enshrined in law under the heading “privacy by design” (or “data protection through technology design”).

This principle applies in particular to the hospital sector, since this involves especially sensitive data that is also protected by criminal law in Germany. An incident like the one in Portugal could therefore also bring the law enforcement authorities on the scene in Germany.


The hospital reportedly plans to take legal action against the fine. In this respect, it remains to be seen whether the competent courts share the legal assessment of the data protection authority and, in particular, consider the amount of the fine to be appropriate.

Basically, according to the known facts, this is a serious case, which, moreover, concerns particularly sensitive data. However, it also shows that the authorities are prepared not only to look for very obvious violations, but also to delve deeper into the systems of those responsible.


The German data protection supervisory authorities issued guidance on the use of hospital information systems years ago. One focus of this guidance is on the design of access rights. It can be assumed that the recommendations contained in the guidance will largely remain valid after the GDPR comes into force.

Those responsible – not only from the healthcare sector – are therefore well advised to put their authorization concepts to the test. In the case of official controls, the responsible party must demonstrate an authorization concept in which access is limited to what is actually required. The controller must also be able to use it to justify why a person needs access to certain data. Even the lack of proof (under the keyword “accountability”) can trigger a fine.

Explore #more

08.12.2023 | PR Publications

Payout can be risky

In the current issue of Personalwirtschaft from 30.11.2023, there is a guest article by Stefan Middendorf and Gracjan Modrzyk. Some companies are once again…

07.12.2023 | PR Publications

Institutional Money – It’s all in the mix

Institutional Money 04/2023 discusses the opportunities offered by the Neighborhood Fund. The fund is ideal for real estate investors, as it is not limited to

01.12.2023 | PR Publications

WiWo: Best of Legal Awards – Philipp Glock Leader of the Year

On Thursday evening, WirtschaftsWoche honored outstanding projects and minds from consulting firms and law firms in Düsseldorf and celebrated the second Best of Professional Night…

29.11.2023 | KPMG Law Insights

Energy transition also opens up business opportunities

The energy industry’s complex, capital-intensive transformation process offers investors and banks a great deal of potential By Lars Christian Mahler and Marc Goldberg for Börsen-Zeitung,…

29.11.2023 | KPMG Law Insights

Guest article in ZURe – AI and the legal department of tomorrow

The current issue of ZURe (p. 48 ff.) contains a guest article by KPMG Partner Sina Steidel-Küster (Regional Director Southwest, Head of Stuttgart office) and…

29.11.2023 | KPMG Law Insights, KPMG Law Insights

Key Facts about the new draft of the “Data Act

On February 23, 2022, the EU Commission presented the new draft of the so-called Data Act, the “Regulation on harmonized rules for fair access to…

21.11.2023 |

Guest article in ZURe on the implementation of CSRD reporting in SMEs

The current issue of ZURe (p. 34 ff.) contains a guest article by Lena Plato (Director Legal & Compliance, FLABEG Automotive Group GmbH), KPMG Law…

20.11.2023 | Press releases

Statement by KPMG Law experts in Handelsblatt on the topic of sustainability cooperation in antitrust law

In the Handelsblatt, KPMG Law expert Jonas Brueckner is quoted in detail on the subject of cooperation in terms of sustainability. Until this summer, there…

15.11.2023 |

Legal 500 – Country Comparative Guide Germany

Gerrit Rixen and Jonas Brueckner provide an overview of the relevant legal regulations in the area of Competition & Litigation in a practical guide on…

14.11.2023 | Press releases

Tax and Law at a glance – New issue of the digital magazine “Talk

“Talk” stands for Tax and Law Compass, because that’s what the digital magazine wants to be: a navigation aid to the legal and tax aspects…


Sebastian Hoegl, LL.M. (Wellington)

Senior Manager
Specialist lawyer for IT law
LL.M. (Wellington)

Heinrich-von-Stephan-Straße 23
79100 Freiburg im Breisgau

tel: +49 761 769999-20

© 2023 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.