Not named in the source

What happened

The Latvian DPA found the use of a personal unique identifier was insufficient to clearly identify a data subject and prevent unlawful disclosure of special categories of data by the national health service provider. The use of additional criteria, such as the data subject's name, was necessary.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 24Responsibility of the controller24(1)Read →
• Art. 32Security of processing32(1)(b)Read →

• Accountability
• Data security