A recent study published in the *Archives of Public Health* has revealed that fines imposed under the General Data Protection Regulation (GDPR) in the healthcare sector across Europe have reached a total of €16,045,309. The research, carried out by David Jirsa and Anna Horňáková, analyzed publicly reported enforcement actions from 25 May 2018 to 31 December 2023, assessing how these actions vary across jurisdictions within the European Union and the European Economic Area.
The analysis included 207 healthcare-related enforcement decisions drawn from 23 of the 30 jurisdictions where the GDPR is enforceable. Researchers utilized data from the CMS GDPR Enforcement Tracker, focusing on enforcement frequency, fine amounts, GDPR provisions cited, and annual distribution of decisions. Among these cases, fine information was accessible for 192 decisions.
The study found significant differences in the number of reported enforcement actions and the sizes of fines across jurisdictions. Despite the GDPR’s uniform application, reported activities were inconsistent, indicating that regulatory enforcement does not provide equal visibility or outcomes across the continent.
Article 5 of the GDPR, which relates to principles of data processing, was cited in 61.8% of the analyzed decisions. Other frequently cited provisions included Article 32 (42.0%), Article 9 (28.5%), and Article 6 (19.3%).
The annual data revealed a trend in enforcement actions, with reported decisions increasing from one in 2018 to 62 in 2022, followed by a decrease to 47 in 2023. Researchers emphasized that while these enforcement decisions provide insights into regulatory practices, they do not directly indicate compliance levels, enforcement intensity, or cybersecurity maturity within the healthcare sector.
This comparative analysis serves as a baseline for understanding GDPR enforcement in healthcare, highlighting the importance of jurisdiction-specific indicators and measures of regulatory effectiveness and digital maturity. The findings aim to foster further research and dialogue on the regulation of personal data within the increasingly digital landscape of healthcare.
