Iceland’s data protection authority, the Persónuvernd, fined the Capital Region Health Service ISK5 million after determining it allegedly did not show it had a legal basis to merge its record systems with other parties under the Medical Records Act. Those other parties were able to access records outside their institution.
Full story