1.5 million Euro fine against DEDALUS BIOLOGIE
Health data of nearly 500,000 people accessible to anyone without access control on web server.
| fineID | Date | Fine | Recipient | Country | Infringement | href | Land |
|---|
Fine details
In February 2021, Dedalus, a provider of software and related services for medical laboratories, made headlines with a data breach that exposed the health data of nearly 500,000 individuals. The compromised data included the full names, national insurance numbers, medical information on conditions, treatments and genetic data of the affected individuals.
The company had stored the data without encryption and sufficient authentication on a server that was exposed to public access via the internet. The French data protection authority CNIL considered this to be a serious breach of Article 32 of the GDPR.
In addition, Dedalus had collected more data in the course of its processing activities for laboratories than was necessary for the intended purpose. The CNIL considered this to be a violation of Art. 29 DSGVO.
The authority also found that the contractual basis between Dedalus and its clients did not comply with the requirements of Art. 28 GDPR.
The amount of the fine imposed represents the maximum amount allowed under French regulations, which underlines the assessment of the seriousness of the infringement.
