French CNIL Fines Hôpital Privé de la Loire EUR 500,000 for Health Data Violations
Fine: EUR 500,000
On 3 September 2026, the French data protection authority CNIL fined Hôpital Privé de la Loire EUR 500,000 for failing to secure patient data and inform all affected individuals of a breach. The hospital's computerised patient file was accessed by an attacker, compromising data for 524,867 patients and 202,246 trusted third parties. This decision highlights critical security lapses and notification failures under the General Data Protection Regulation (GDPR).
The investigation revealed that the authentication procedure for external users of the computerised patient file lacked both a virtual private network (VPN) and multifactor authentication, a vulnerability exploited by the attacker. Furthermore, the hospital's authorisation policy was insufficient, as it did not limit access based on care teams, enabling a single user account to access all patient data.
The hospital also lacked real time or short term detection mechanisms for suspicious activity within its computerised patient file, allowing the attacker to explore and extract a significant volume of data undetected over several days. The CNIL also identified a breach of Article 34 of the GDPR because the hospital failed to directly inform 202,246 individuals designated as trusted third parties about the data breach, despite their personal data also being compromised. The sanction amount considered the lack of essential security principles, the number of affected individuals, the sensitive nature of the compromised data, and the hospital's financial capacity. The restricted committee also ordered the hospital to complete the implementation of security measures within three to fifteen months, depending on the type of measure.
Healthcare organisations frequently face scrutiny over their handling of sensitive patient data, as evidenced by this EUR 500,000 fine.
Original title: Violation de données en matière de santé : sanction de 500 000 euros à l’encontre de l’HÔPITAL PRIVÉ DE LA LOIRE
CNIL sanction decision SAN 2026 009
- Who this binds
- Hôpital Privé de la Loire is legally bound by the CNIL's decision under the General Data Protection Regulation (GDPR) in France.
- What changed
- Hôpital Privé de la Loire must complete the implementation of security measures within three to fifteen months as ordered by the CNIL's restricted committee.
- What to check
- Organisations should review their authentication procedures for external users and their authorisation policies to ensure they align with GDPR Article 32 requirements.
- What this does not mean
- This decision does not mean that all data breaches automatically result in a EUR 500,000 fine, as the CNIL considered specific factors like data sensitivity and financial capacity.
Send this to your team
The French CNIL fined Hôpital Privé de la Loire EUR 500,000 for GDPR security and notification failures, requiring the hospital to implement security improvements within fifteen months.