Real cases
Sold or shared, as we file it: the record or health data was sold, shared with marketers or other parties, or published without consent.
Published October 2024 to October 2026, found in sources in 24 languages: 68 of all 442 cases. By region, 9 in Africa, 14 in the Americas, 13 in Asia, 22 in Europe, 9 in the Middle East and 1 in Oceania. Of these, a regulator or court decided 41, the organization involved admitted 1 and 26 are allegations not decided. The sources: 19 decisions by regulators and ombudsmen, 3 court judgments and 46 reports by edited news outlets. 20 decisions are known to us from a news report of it. The list last changed on October 4, 2026.
Each case is filed under one kind of problem when it is written, by the rule above; the cases here are the ones filed under it. These cases are not a sample: they show what is published and findable, not how common sales and sharing of health data are.
Each case's id links its line on Real cases, the one address to cite. Every case, every kind of problem, by country: Real cases.
all cases that month cases filed as sold or shared a month not yet over every panel on the same scale, 0 to 15 cases a month
Each bar counts the cases whose source was published that month, October 2024 to October 2026, by region. Pick a kind of problem to see its share of each bar. Counts show what was published and what our searches found, not how often problems happen. October 2026 runs only to October 3, 2026, the newest source date, so its bars are drawn as outlines. Every case as a spreadsheet (CSV).
| Month | Africa | Americas | Asia | Europe | Middle East | Oceania | All |
|---|---|---|---|---|---|---|---|
| October 2024 | 0 | 1 | 0 | 2 | 1 | 0 | 4 |
| November 2024 | 0 | 0 | 0 | 1 | 0 | 0 | 1 |
| December 2024 | 0 | 1 | 1 | 1 | 0 | 0 | 3 |
| January 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| February 2025 | 0 | 0 | 0 | 0 | 1 | 0 | 1 |
| March 2025 | 0 | 0 | 1 | 0 | 0 | 0 | 1 |
| April 2025 | 0 | 1 | 3 | 1 | 0 | 0 | 5 |
| May 2025 | 0 | 0 | 1 | 2 | 0 | 0 | 3 |
| June 2025 | 0 | 0 | 1 | 1 | 0 | 0 | 2 |
| July 2025 | 1 | 1 | 0 | 0 | 0 | 0 | 2 |
| August 2025 | 0 | 1 | 1 | 0 | 0 | 0 | 2 |
| September 2025 | 0 | 2 | 1 | 4 | 0 | 0 | 7 |
| October 2025 | 0 | 0 | 1 | 1 | 0 | 0 | 2 |
| November 2025 | 0 | 0 | 0 | 1 | 0 | 0 | 1 |
| December 2025 | 1 | 0 | 0 | 1 | 0 | 0 | 2 |
| January 2026 | 1 | 1 | 0 | 1 | 0 | 0 | 3 |
| February 2026 | 2 | 0 | 0 | 2 | 2 | 0 | 6 |
| March 2026 | 0 | 0 | 0 | 0 | 0 | 1 | 1 |
| April 2026 | 0 | 1 | 0 | 1 | 0 | 0 | 2 |
| May 2026 | 0 | 1 | 0 | 0 | 2 | 0 | 3 |
| June 2026 | 0 | 1 | 2 | 2 | 2 | 0 | 7 |
| July 2026 | 0 | 2 | 0 | 0 | 0 | 0 | 2 |
| August 2026 | 2 | 1 | 1 | 0 | 0 | 0 | 4 |
| September 2026 | 2 | 0 | 0 | 0 | 1 | 0 | 3 |
| October 2026 (so far) | 0 | 0 | 0 | 1 | 0 | 0 | 1 |
| All | 9 | 14 | 13 | 22 | 9 | 1 | 68 |
| How settled | Africa | Americas | Asia | Europe | Middle East | Oceania | All |
|---|---|---|---|---|---|---|---|
| A regulator or court decided | 2 | 9 | 6 | 20 | 4 | 0 | 41 |
| The organization admitted the problem | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Alleged, not decided | 6 | 5 | 7 | 2 | 5 | 1 | 26 |
| All | 9 | 14 | 13 | 22 | 9 | 1 | 68 |
| Kind of source | Africa | Americas | Asia | Europe | Middle East | Oceania | All |
|---|---|---|---|---|---|---|---|
| Regulator and ombudsman decisions | 1 | 4 | 4 | 10 | 0 | 0 | 19 |
| Court judgments | 0 | 0 | 0 | 3 | 0 | 0 | 3 |
| News reports | 8 | 10 | 9 | 9 | 9 | 1 | 46 |
| All | 9 | 14 | 13 | 22 | 9 | 1 | 68 |
· PPC Land · archived copy
Italy's data protection authority found a health data company treated records of about one million GP patients as anonymous when they were personal, processing them without legal basis or patient notice; identifiers of 3,370 patients also slipped through.
Sold or shared A regulator decided Case ITA-S006 on Real cases Italy: the country page
· Akhbar Al Khaleej · archived copy
After a citizen complained, the Personal Data Protection Authority found a medical centre had emailed information and a document about his medical tests to his employer without valid prior consent or legal basis, and fined it 1,000 dinars.
From an Arabic source; summary ours.
Sold or shared A regulator decided Case BHR-S001 on Real cases Bahrain: the country page
· MZNews · archived copy
A civil society leader says the terms of the health data sharing agreement are opaque and asks the ministry to publish them, including whether data sent abroad is anonymised or individual clinical records, and how long it is kept.
From a Portuguese source; summary ours.
Sold or shared Alleged, not decided Case MOZ-S002 on Real cases Mozambique: the country page
· Nawaat
An investigative outlet found that a regional authority published online a named list of disabled people holding taxi licences, revealing health information about each person, while the national data protection regulator remains frozen.
From an Arabic source; summary ours.
Sold or shared Alleged, not decided Case TUN-S001 on Real cases Tunisia: the country page
· La República
A clinic emailed a patient's complete record, covering about fifteen years, to prosecutors without her consent, her representative's approval or a court order. The national health regulator found this broke health law and fined the clinic.
From a Spanish source; summary ours.
Sold or shared A regulator decided Case PER-S001 on Real cases Peru: the country page
· APAnews (African Press Agency)
Eswatini signed a US health funding agreement that, under the wider scheme, trades funding for access to pathogen samples and surveillance data. Critics warned the deal could expose the country's health data to abuse.
Sold or shared Alleged, not decided Case SWZ-S002 on Real cases Eswatini: the country page
· Democratic Voice of Burma (DVB) · archived copy
People close to a military-guarded public hospital in Sagaing Region say staff notify the army when emergency patients arrive, and treatment waits until soldiers and police have checked them, so patient details reach security forces first.
From a Burmese source; summary ours.
Sold or shared Alleged, not decided Case MMR-S001 on Real cases Myanmar: the country page
· The Investigator News
A man brought to a hospital under guard says staff passed his test results to the officers holding him and never gave or explained them to him. He also says the hospital recorded him under another name.
Sold or shared Alleged, not decided Case UGA-S002 on Real cases Uganda: the country page
· U.S. Federal Trade Commission
A federal regulator, joined by two states, alleges a telehealth company passed customers' health information to advertising platforms through customer lists and website tracking, despite privacy promises. The case is pending in federal court.
Sold or shared Alleged, not decided Case USA-S011 on Real cases United States: the country page
· Le Nouvelliste · archived copy
The paper reports that a woman says a health worker disclosed confidential health information about her, and it spread among people around her. A doctor quoted in the piece says confidentiality breaches happen.
From a French source; summary ours.
Sold or shared Alleged, not decided Case HTI-S001 on Real cases Haiti: the country page
· Roya News · archived copy
Health insurers and their industry union told insured people not to use a non-insurer claims platform, saying its access to patients' medical data breaks the personal data protection law and delays approvals for treatment.
From an Arabic source; summary ours.
Sold or shared Alleged, not decided Case JOR-S001 on Real cases Jordan: the country page
· Bizim Sakarya
Staff at a public hospital copied patients' identity and contact details from the hospital information system and passed them to unlicensed insurance claims firms for commission. Health Ministry inspectors dismissed staff and suspended a doctor; a criminal investigation continues.
From a Turkish source; summary ours.
Sold or shared A regulator decided Case TUR-S001 on Real cases Turkey: the country page
· Central News Agency (中央社)
Prosecutors charged two men with paying cryptocurrency for a file of about 20,000 hospital patients' visit and health records stolen by hackers, then advertising hospital data for sale on a messaging app. Prosecutors asked for heavy sentences.
From a Chinese source; summary ours.
Sold or shared Alleged, not decided Case TWN-S002 on Real cases Taiwan: the country page
· Arab Times (Kuwait), citing Al-Seyassah · archived copy
A doctor published a patient's photograph, taken in connection with her care, on social media and advertising platforms without her consent. The Court of Appeals found this disclosed confidential medical information and imposed a fine.
Sold or shared A regulator decided Case KWT-S001 on Real cases Kuwait: the country page
· Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)
While on sick leave and about to leave a public primary care centre, a doctor viewed 1,231 patients' files in its records system and used their contacts to email and text them. The regulator fined the doctor 1,153 euros.
From a Lithuanian source; summary ours.
Sold or shared A regulator decided Case LTU-S003 on Real cases Lithuania: the country page
· Divergentes
Officials discussed a person's health history and private life at a press conference. Specialists interviewed said this breached confidentiality standards for health information.
From a Spanish source; summary ours.
Sold or shared Alleged, not decided Case NIC-S001 on Real cases Nicaragua: the country page
· 21st Century Business Herald (21经济网) · archived copy
A national cybersecurity notice listed 71 apps breaking personal data rules, including several medical and health apps. Violations included giving personal data to third parties without separate consent, no way to withdraw consent, and missing encryption.
From a Chinese source; summary ours.
Sold or shared A regulator decided Case CHN-S005 on Real cases China: the country page
· La Nación · archived copy
Two television channels broadcast images of a person's medical prescriptions taken from a confidential case file. The constitutional court ruled this violated his privacy, ordered every image removed and made the channels liable for damages.
From a Spanish source; summary ours.
Sold or shared A regulator decided Case CRI-S001 on Real cases Costa Rica: the country page
· Al-Ain News
Security sources told the outlet that hospitals and clinics in Houthi-held areas were linked to a new security unit and pressed to hand over daily details of patients and cases, building a health database on residents.
From an Arabic source; summary ours.
Sold or shared Alleged, not decided Case YEM-S001 on Real cases Yemen: the country page
· Al Watan
Callers told the paper that hospital booking lines, staffed from outside the kingdom, asked for ID numbers, birth dates and full patient details before sending them to an app. Security specialists warned of leak and misuse risks.
From an Arabic source; summary ours.
Sold or shared Alleged, not decided Case SAU-S003 on Real cases Saudi Arabia: the country page
· Медвестник
An unplanned inspection by the Vologda regional health ministry found that the head of an ambulance service had passed data on patients it carried to third parties. He was dismissed and the material was sent to oversight bodies.
From a Russian source; summary ours.
Sold or shared A regulator decided Case RUS-S002 on Real cases Russia: the country page
· La FM
Sensitive details from a woman's health record reached third parties without her consent. The data protection regulator found the hospital and her health insurer at fault and ordered five corrective measures, including staff training and stronger confidentiality.
From a Spanish source; summary ours.
Sold or shared A regulator decided Case COL-S001 on Real cases Colombia: the country page
· InDaily (South Australia) · archived copy
After a South Australian patient spoke publicly about her care, the state health minister's office shared confidential details about her with journalists, the opposition claimed. She says she did not consent.
Sold or shared Alleged, not decided Case AUS-S005 on Real cases Australia: the country page
· Mbote · archived copy
A Kinshasa outlet reports that Congo joined 14 African countries in US health deals that tie funding to expanded health data systems and fast reporting, while critics warn of lost control over health data and public trust.
From a French source; summary ours.
Sold or shared Alleged, not decided Case COD-S001 on Real cases Democratic Republic of the Congo: the country page
· ANSPDCP (National Supervisory Authority for Personal Data Processing)
A former employee copied every patient's contact details and medical file and used them to invite patients to a competing clinic. The clinic then failed to answer the regulator, which fined it.
From a Romanian source; summary ours.
Sold or shared A regulator decided Case ROU-S001 on Real cases Romania: the country page
· Khabar Online · archived copy
A member of parliament's health committee confirmed a security council letter asking medical universities for patients' records after the January protests. He said the health ministry objected in confidential correspondence, citing patient confidentiality.
From a Persian source; summary ours.
Sold or shared Alleged, not decided Case IRN-S002 on Real cases Iran: the country page
· Conseil d'État · archived copy
Doctors' software gathered patients' health data, such as prescriptions and sick leave, with identifiers that allowed care pathways to be traced. The court agreed the data were not anonymous and rejected the company's challenge to an 800,000 euro fine.
From a French source; summary ours.
Sold or shared A court decided Case FRA-S001 on Real cases France: the country page
· BBC News Afrique
BBC reported that a gendarmerie press release quoted a medical certificate from a test that police had ordered on a person in custody, including what it found.
From a French source; summary ours.
Sold or shared Alleged, not decided Case SEN-S004 on Real cases Senegal: the country page
· Radio Zamaneh
Reports cited by the outlet say security officers checked hospital records of discharged patients and pressed medical staff to report certain patients, and many people avoided hospitals for fear of arrest.
From a Persian source; summary ours.
Sold or shared Alleged, not decided Case IRN-S003 on Real cases Iran: the country page
· Dnes Bulgaria · archived copy
A patient said on television that her discharge record was wrong. A hospital director responded on air with her health details. The data protection commission fined the hospital 10,000 leva, rejecting its consent argument.
From a Bulgarian source; summary ours.
Sold or shared A regulator decided Case BGR-S004 on Real cases Bulgaria: the country page
· Darío Medios · archived copy
The outlet reports that a public hospital published photos of patients undergoing scans, some partly undressed and recognisable, in political messaging. Lawyers and health workers say this breaks the health law's confidentiality rules; no explanation was given.
From a Spanish source; summary ours.
Sold or shared Alleged, not decided Case NIC-S003 on Real cases Nicaragua: the country page
· Business Daily (reporting a Data Protection Commissioner decision)
The regulator found a staff member recorded a patient during treatment and the hospital showed the footage on its screens as promotion. It could not prove consent, so it must pay Sh500,000 and delete the adverts.
Sold or shared A regulator decided Case KEN-S005 on Real cases Kenya: the country page
· Information Commissioner's Office · archived copy
An insurer asked for five years of records, to go to the patient first for review. The surgery emailed 23 years straight to the insurer. The patient said their payout was cut. The ICO issued a reprimand.
Sold or shared A regulator decided Case GBR-S001 on Real cases United Kingdom: the country page
· Carta de Moçambique
Reporting a health ministry statement, the outlet says a five-year US funding memorandum includes an agreement to share national health data and biological samples, which the government says will follow national data protection rules.
From a Portuguese source; summary ours.
Sold or shared The organization admitted the problem Case MOZ-S001 on Real cases Mozambique: the country page
· Persónuvernd (Icelandic Data Protection Authority)
The national hospital sent an adult patient's sensitive health information to a primary care clinic she was not registered with. The data protection authority ruled the disclosure unlawful; the hospital said it regretted the mistake.
From an Icelandic source; summary ours.
Sold or shared A regulator decided Case ISL-S002 on Real cases Iceland: the country page
· Federal Administrative Court (Bundesverwaltungsgericht), W108 2276075-1, upholding a Datenschutzbehörde decision · archived copy
A patient learned during a court case that a hospital report about them had reached third parties. The regulator found the hospital's security manager had copied the electronic record and emailed it to police. The court upheld that finding.
From a German source; summary ours.
Sold or shared A court decided Case AUT-S001 on Real cases Austria: the country page
· The Edition · archived copy
A public hospital released a statement giving health details of a named patient. Lawyers said this broke the patient confidentiality article of the Health Services Act, which allows disclosure only with written consent, a court order or a legal duty.
Sold or shared Alleged, not decided Case MDV-S001 on Real cases Maldives: the country page
· U.S. Department of Health and Human Services, Office for Civil Rights
A complaint said a group of care facilities put a patient's name, photo and care details on its website as a success story. The regulator found the same had happened to 150 patients without valid written authorization.
Sold or shared A regulator decided Case USA-S003 on Real cases United States: the country page
· OjoPúblico
Reporters found private clinics and health insurers collecting sensitive health and personal data without consent and using it beyond care. Misuse led to one patient's suspension from work and to marketing harassment; regulators fined the sector over four million soles.
From a Spanish source; summary ours.
Sold or shared Alleged, not decided Case PER-S004 on Real cases Peru: the country page
· Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Ετήσια Έκθεση 2024)
A man complained that two doctors issued certificates about his past care to his former wife without his knowledge or consent. The regulator found they processed his health data with no legal basis and reprimanded both.
From a Greek source; summary ours.
Sold or shared A regulator decided Case CYP-S003 on Real cases Cyprus: the country page
· Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Ετήσια Έκθεση 2024)
A doctor's secretary looked up a patient's GeSY account and phoned his father, listed as next of kin, to confirm a booking. The regulator ruled that number was not an alternative contact and reprimanded the doctor.
From a Greek source; summary ours.
Sold or shared A regulator decided Case CYP-S004 on Real cases Cyprus: the country page
· The Business Standard · archived copy
The national health directorate told government hospitals that pharmaceutical sales representatives may no longer photograph prescriptions, patient information or hospital documents, and warned of legal action against anyone who breaks the rule.
Sold or shared Alleged, not decided Case BGD-S003 on Real cases Bangladesh: the country page
· DR · archived copy
Experts said two regions gave a research project access to 3.65 million people's hospital records without first assessing data protection risks. A regional director said the analysis perhaps should have been done. The regulator opened an inquiry.
From a Danish source; summary ours.
Sold or shared Alleged, not decided Case DNK-S003 on Real cases Denmark: the country page
· Diari d'Andorra · archived copy
Acting on one person's complaint, the data protection authority found that a closing clinic handed clinical files to another clinic without consent or notice, and that both lacked safeguards. It warned both and ordered proof of compliance.
From a Catalan source; summary ours.
Sold or shared A regulator decided Case AND-S001 on Real cases Andorra: the country page
· El Tiempo · archived copy
During a workplace illness review, a health insurer sent a patient's complete record, including sensitive test results, to four managers at the patient's employer. The data protection regulator sanctioned the insurer, saying the disclosure had no necessity or relevance.
From a Spanish source; summary ours.
Sold or shared A regulator decided Case COL-S002 on Real cases Colombia: the country page
· VietTimes
Patients described being phoned with sales offers soon after hospital discharge. A security expert found patient names, phone numbers and medical history sold cheaply on a messaging app. Some hospitals stayed silent about attacks, the report says.
From a Vietnamese source; summary ours.
Sold or shared Alleged, not decided Case VNM-S003 on Real cases Vietnam: the country page
· ERIS (Entidade Reguladora Independente da Saúde)
Following a complaint, the regulator learned that several health facilities sent patient samples abroad for lab work, sharing sensitive personal data. It issued an alert reminding providers that patient consent is required.
From a Portuguese source; summary ours.
Sold or shared A regulator decided Case CPV-S001 on Real cases Cape Verde: the country page
· California Department of Justice, Office of the Attorney General
The state found a health information website sent identifiers and the titles of articles readers viewed to advertisers, ignored opt-out requests, and ran a consent banner that did not stop tracking. It paid $1.55 million.
Sold or shared A regulator decided Case USA-S009 on Real cases United States: the country page
· Sai Gon Giai Phong
Two adult patients said clinics posted images or livestreamed their consultations for promotion without clear consent; one learned colleagues had seen the video. A city health department head condemned the practice, citing confidentiality rules.
From a Vietnamese source; summary ours.
Sold or shared Alleged, not decided Case VNM-S004 on Real cases Vietnam: the country page
· Data Protection Commission (Annual Report 2024 case studies) · archived copy
A worker was sent by their employer to a medical facility. The facility gave the employer, including the HR department, full consultation notes with past medical history, assuming consent. The regulator found the disclosure unlawful.
Sold or shared A regulator decided Case IRL-S005 on Real cases Ireland: the country page
· Hessian Commissioner for Data Protection and Freedom of Information (HBDI) · archived copy
Patients left anonymous negative reviews online. Medical practices replied in public, naming the patients and disclosing details from their records. The state regulator listed these among cases where it imposed fines in 2024.
From a German source; summary ours.
Sold or shared A regulator decided Case DEU-S001 on Real cases Germany: the country page
· Призма (BIRN North Macedonia) · archived copy
A patient seeking urgent treatment saw a clinician who looked in the national electronic record, learned of a sensitive entry and refused even a basic exam. The patient has sued for discrimination; advocates say any doctor can see everything.
From a Macedonian source; summary ours.
Sold or shared Alleged, not decided Case MKD-S002 on Real cases North Macedonia: the country page
· Legal Daily (via Hunan Daily / voc.com.cn) · archived copy
Reporters found some hospital staff and outside contractors selling patients' names, addresses and phone numbers to private companies, about 50 yuan per record. A patient described being contacted by a company that already knew her private details.
From a Chinese source; summary ours.
Sold or shared Alleged, not decided Case CHN-S007 on Real cases China: the country page
· Malaysian Medical Council · archived copy
The Malaysian Medical Council found a doctor guilty of posting a complainant's personal information on a clinic's Facebook page without written consent, failing to protect patient confidentiality, and suspended the doctor for two years.
Sold or shared A regulator decided Case MYS-S001 on Real cases Malaysia: the country page
· Malaysian Medical Council · archived copy
The Malaysian Medical Council found a doctor guilty of posting a patient's personal and medical information on a social media account without written consent, against a promise not to reveal it, and issued a reprimand.
Sold or shared A regulator decided Case MYS-S002 on Real cases Malaysia: the country page
· Malaysian Medical Council · archived copy
The Malaysian Medical Council found a doctor guilty of disclosing a complainant's medical report, without consent, in an affidavit filed in court proceedings against the complainant, and issued a reprimand.
Sold or shared A regulator decided Case MYS-S004 on Real cases Malaysia: the country page
· Netgazeti · archived copy
The clinic's director published a patient's X-ray image on her personal social media page. On the patient's complaint, the data protection regulator found the clinic processed health data unlawfully, issued a warning and ordered the post removed.
From a Georgian source; summary ours.
Sold or shared A regulator decided Case GEO-S001 on Real cases Georgia: the country page
· U.S. Federal Trade Commission
The regulator's administrator began a second round of payments, over $2.6 million, to customers of an online counseling service. Under a 2023 order, the company paid $7.8 million for sharing email addresses and health questionnaire answers with advertisers.
Sold or shared A regulator decided Case USA-S008 on Real cases United States: the country page
· National Human Rights Commission of Mongolia, 24th report on human rights · archived copy
A relative complained that a hospital head described a patient's health in a live interview with a news site. The commission found this broke the personal data law; the hospital head was warned and the press council asked to review.
From a Mongolian source; summary ours.
Sold or shared A regulator decided Case MNG-S002 on Real cases Mongolia: the country page
· Al-Jarida
A patient sought damages after a doctor published before-and-after photos in a hospital magazine. The appeal court found a confidentiality breach; the Court of Cassation held that patient consent, including implied consent, can lift the duty of secrecy.
From an Arabic source; summary ours.
Sold or shared A regulator decided Case KWT-S002 on Real cases Kuwait: the country page
· Pharmnews
Three senior doctors at a Seoul hospital gave drug company staff patients' prescription records, more than 17,000 entries, at the company's request. A court fined the doctors and the hospital's operator for failing to prevent it.
From a Korean source; summary ours.
Sold or shared A regulator decided Case KOR-S003 on Real cases South Korea: the country page
· Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 50/2024 · archived copy
A patient complained that her doctor posted photos taken during her care on his social media page. The regulator ruled that keeping them up after she withdrew consent was unlawful and ordered his consent forms rewritten.
From a Greek source; summary ours.
Sold or shared A regulator decided Case GRC-S003 on Real cases Greece: the country page
· Hoje em Dia · archived copy
Minas Gerais consumer authority Procon fined a pharmacy chain over stores requiring customers' CPF at the counter. The decision warned hidden profiling of purchases could expose medicine records, for example to insurers refusing cover.
From a Portuguese source; summary ours.
Sold or shared A regulator decided Case BRA-S005 on Real cases Brazil: the country page
· Regionaal Tuchtcollege voor de Gezondheidszorg 's-Hertogenbosch · archived copy
During a civil case he brought against a patient, a doctor passed her medical data to an outside expert without asking her. The tribunal found confidentiality was breached and reprimanded him.
From a Dutch source; summary ours.
Sold or shared A court decided Case NLD-S003 on Real cases Netherlands: the country page
· Kayhan · archived copy
Doctors and clinics posted patients' photos, videos and record details on social media pages. The health ministry referred 333 pages to prosecutors, who blocked them, and cases went to courts and the medical council.
From a Persian source; summary ours.
Sold or shared A regulator decided Case IRN-S001 on Real cases Iran: the country page
· El Colombiano
Clinic staff shared a woman's personal and medical details with an outside organisation, which then called and messaged her. The Constitutional Court ruled her privacy was violated and ordered the clinic to apologise publicly and investigate its staff.
From a Spanish source; summary ours.
Sold or shared A regulator decided Case COL-S003 on Real cases Colombia: the country page
· Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 37/2024 · archived copy
People who had been treated at a public hospital received election text messages from a doctor there who was a candidate. He could not show how he got their numbers; the regulator fined him 15,000 euros.
From a Greek source; summary ours.
Sold or shared A regulator decided Case GRC-S004 on Real cases Greece: the country page
· DR · archived copy
After inspecting eight research projects using health information, the data protection authority gave serious criticism: the university had several times passed personal data on without the required permission and supervised partners poorly. The university said it takes the criticism seriously.
From a Danish source; summary ours.
Sold or shared A regulator decided Case DNK-S005 on Real cases Denmark: the country page
Cases as of . Our summaries are free to reuse with credit to SuperTruth (CC BY 4.0).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI · Follow changes