AI Training

In its latest revision, the EU Digital Omnibus states that anybody could use any personal data to train AI based on its legitimate interest. 

So, of course, a lot of digital health organisations will scroll the web in search for patient data, train their AI algorithms with such data, without all the IT and organisational security measures mandated by the GDPR. In other words, patient data could leak.

Our opinion at PharMarketing GDPR Life Sciences is that it could have important impacts on the private life of patients and lead to important psychological problems, which in turn is against the 'spirit' of the GDPR.

Clinical research data are NOT personal data anymore

Also, the EU Digital Omnibus states that de-identified personal data could be considered as not being personal data in some situations, creating a Big precedent, in particular for clinical trial data and for retrospective studies patient data.

As you might be aware, clinical study reports can contain de-identified patient data. And pharma companies must make them public according to EU 070 Regulation ('open data act'), otherwise the clinical study will not be approved.

This is why the GDPR has always considered that de-identified personal data ('pseudonymised' personal data as the GDPR calls it) are still personal data and fall under GDPR.

So what does the EU Digital Omnibus say?

The new article 25a of the EU Digital Omnibus states that “pseudonymised data shall not be considered personal data for a third party if that person is unable to identify the natural person to whom the data relates.” This creates a subjective assessment of what is and is not personal data, effectively allowing companies to decide whether or
not they choose to comply with the GDPR. 

And you can be sure that many organizations will claim they can not reidentify the patients. This is in opposition to many research which have demonstrated that it is always possible to reidentify a patient if you have access to another source of information: 

Remember 2 years ago when several researchers from Norway managed to reidentify European patients in a server made public by the FDA: subsequently the EMA sent a letter to all PV and Quality representatives in the EU, asking them to redact more infos in the Eudravigilance Database.

To learn more contact Bertrand at b.p.lebourgeois@pharmarketing.net

Data Protection Authorities ('DPAs') published several decisions related to the processing of health data in the past months.

Such decisions shed light on the key measures to implement to stay compliant with privacy (and healthcare) laws and avoid a critical finding.

For each decision, we propose key takeaways: use them as ideas and guidelines for your own organisations: check that such measures are implemented at your organisation, and if not, talk to your management (or talk to us!).

Many thanks to GDPR hub NOYB and to IAPP for all this valuable information!

Australia:

Fact:

The Australian government has initiated a review into a hacking incident in which tech giant OpenAI’s artificial intelligence (AI) model secured unintended access to private health files, marking one of the first publicly reported examples of an AI-led hack impacting a government website.

As per the BBC, which first reported the breach, OpenAI’s model gained access to files from several government websites and services in June after it was tasked with health statistics research. This includes data from Australia’s public health scheme, Medicare, which is not available to the public.

While the hacking incident occurred in June, OpenAI claims it was not aware of the event until August! After discovering the breach, OpenAI informed Australian authorities of the incident on 10 September via an email to the Services Australia general email inbox. 

OpenAI noted an “extensive review of misaligned model activity” found no evidence of patient records being accessed: it looks only statistics were accessed and as you know statistics are NOT personal data.  OpenAI holds partnerships with a broad range of life sciences companies, including pharma giants like Novo and Eli Lilly, as well as Thermo Fisher Scientific’s clinical trials business. Read full article from GlobalData here: https://www.globaldata.com/new... Read BBC article here: https://www.bbc.com/news/live/...

Takeaway:

All organizations storing patient data, whether in clear or de-identified, should protect access with the best IT and organizational security measures. One of such measure is post-quantum encryption, which is the ONLY robust security measures to fight AI cyberattacks: refer to our July/August 2026 Newsletter for details on this new technology. 

Austria:

Fact:

The Austrian DPA held that health data that is required for an expert opinion in a court proceeding can be processed under Article 9(2)(f) GDPR and Article 9(2)(g) GDPR in conjunction with Austrian national law and the selection of relevant data is at the discretion of the expert. Read more or edit on https://gdprhub.eu/index.php?t...

Takeaway:

Court proceedings take precedence on 'classic' privacy rules.

Brazil and Latin America:

Fact:

Healthcare appointment site Doctoralia, which serves millions of people in Latin America and Europe, sent sensitive information about their medical appointments, including the specialties and names of doctors, to social media companies including TikTok, Google, and LinkedIn, according to a review of its websites. Doctoralia’s parent company, Docplanner Group, founded in Poland in 2012, says it operates a sprawling platform across 13 countries, from Turkey to Chile, letting 100 million people book 25 million appointments per month across countries, cultures, and languages.

Doctoralia said it would review its practices. Read artcile from The Markup: https://themarkup.org/pixel-hu...

Takeaway:

Privacy laws in South America, in Europe and in most other countries require to inform users on what personal are collected, how they are used and shared etc. A company like Doctoralia might share patient data with social media, but it needs: 1) to identify the legal basis for collecting such patient data and for sharing them with social media companies 2) to inform its users of such transfer of personal data 3) have a data transfer agreement in place with social media companies  4) check that the social media companies comply with privacy laws and have security measures in place 5) Conduct a Data Privacy Impact Assessment as we are talking here of sensitive personal data (heal date) and of vulnerable data subjects (patients) 6) and document everything in its Register of Processing Activities ('ROPA') 

China:

Fact:

The Cyberspace Administration of China ('CAC'), China's Data Protection Authority asked 30 mobile apps to provide information on data collection and consent agreements and implement changes that allow consumers to delete their accounts within 15 business days. This includes healthcare monitoring apps like iNAP Care. Read CAC's press release: https://www.cac.gov.cn/2026-09...

Takeaway:

It's mandatory in China and many other countries to inform people BEFORE you collect their personal data, and in some situations you must obtain their consent. Also, data subjects should be able to exercise their rights on their personal data in a simple manner; this includes the request to delete their personal data.

Fact:

The Cyberspace Administration of China ('CAC') found a weak password vulnerability in the hospital's physical examination system, which allowed access to medical case data and other data. After ordering the hospital to make comprehensive rectifications, the local cyberspace administration found that the hospital's network firewall, intrusion prevention system, vulnerability scanning tools, log audit system, database audit system, fortress computer, and other security devices had failed due to expired authorization. The network system terminals still had 700 security vulnerabilities, including 73 high-risk vulnerabilities that could be exploited, and the risk of data leakage had not been eliminated. The hospital failed to fulfill its obligations for network and data security protection according to law, violating the Cybersecurity Law, Data Security Law, Network Data Security Management Regulations, and other legal provisions. The local Cyberspace Administration has lawfully ordered corrections, issued warnings, and imposed fines, and fined the directly responsible supervisors, while reporting the relevant situation to the local health department.

Takeaway:

In China as in rest of the world, organisations processing patient data should apply the best level of IT and organisational security measures, in accordance to the recommendations of their country's IT security agency.

France:

Fact:

The French DPA, the CNIL, issued a 500 000 euros fine against the Loire Private Hospital ('HÔPITAL PRIVÉ DE LA LOIRE', a French private hospital based in Saint-Etienne and owned by the RAMSAY Group: after a cyberattack exposed personal data of thousands patients, the CNIL conducted an audit of the hospital, which showed that the hospital had not implemented the required Technical and Organizations ('TOMs') security measures.

Comment from PharMarketing: Most French hospitals, whether public or private, have experienced cyberattacks with patient data being exposed, but to our knowledge it's the first time that the CNIL communicates officially on a fine given to a hospital. Read more here (in French): https://www.cnil.fr/fr/sanctio...

Takeaway:

All organizations collecting or processing personal data should implement the TOMs recommended that their country's National IT Security Agency. Especially if organisation processes healthcare personal data. 

Guernsey:

Fact:

Guernsey's Office of the Data Protection Authority claimed a health care provider breached a patient's sensitive personal information by taking a phone call during an examination, BBC News reports. ODPA Commissioner Brent Homan said the organization is providing additional training to doctors to ensure patient privacy remains protected, noting data breaches "are not just about records, but include overheard conversations."
Read more: https://www.bbc.com/news/artic...

Takeaway:

Mobile apps should comply with local privacy laws. In particular, users should be informed on which of their personal data are processed and how, and should be able to exercise their rights on their personal data in a simple way. 

Ireland:

Fact:

Ireland's Data Protection Commission issued a 645,000 euro fine against Health Service Executive, Ireland's healthcare public service. The first breach was notified to the DPC in October 2023, when individuals gained unauthorised access to paper records stored and retained in St. Loman’s Hospital (Mullingar, County Westmeath). St Loman’s Hospital is a former disused psychiatric hospital which is contaminated with asbestos. Another issued psychiatric hospital was also used for storing patient health paper records. The accesses to both disused hospitals were not secured, nor were the access to the patients' documents. The paper documents were damaged by mould, water, animals droppings, rubble and detritus and some paper documents were not readable anymore. This is an important breach of privacy, but also of health laws, as patient information were lost. Read the article from the DPC: https://www.dataprotection.ie/...

Takeaway:

All organisations must implement not only IT security measures, but also security measures for the facilities, the buildings and paper documents. It is of the utmost importance that the facilities manager be associated with the privacy compliance exercise.

Italy:

Fact:

An employee of the University Health Agency of Friuli Centrale (the controller) complained related to the access by the controller, its staff and other healthcare professionals from other facilities to Covid-19 results and surgical department data. It also concerned the lack of access logs. 

After enquiring, the Italian DPA, the Garante, fined the University Health Agency of Friuli Centrale €24,000 for having an inadequate configuration of access to electronic health records, which resulted in unlawful processing of the data subject’s personal data. Read more: https://gdprhub.eu/index.php?t...

Takeaway:

Same as for the cyberattack at the French Loire Private Hospital above.

Netherlands:

Fact:

A court held that Article 16 GDPR does not require rectification of a medical report where the alleged inaccuracies are not objectively verifiable and concern the physician’s account of a past conversation. Read more or edit on GDPRhub… https://gdprhub.eu/index.php?t...

Takeaway:

This is a good example of the interplay between the GDPR and local healthcare laws. The medical opinion of a healthcare professional cannot be discussed and modified after the visit.

Poland:

Fact:

MyDr healthcare software breach potentially affected 19 million people. MyDr, a privately-owned Polish company that supplies software to doctors, clinics and other healthcare providers, said in August that it had identified and removed the cause of the incident and introduced additional security measures. It did not provide details about the vulnerability or how the attackers gained access. Poland's Personal Data Protection Office plans to inspect MyDr, while security agencies are working to identify those responsible for the attack. Read article from The Record: https://therecord.media/poland...

Takeaway:

We cannot comment as the cause of the cyberattack has not been disclosed.

Spain:

Fact:

Suspecting unauthorised access to his medical records, a public civil servant, the data subject, requested the Ministry of Defence, the controller, to provide a log copy of accesses to his medical history, including the date, time, identity of the professional and purpose of each access. 

The Spanish DPA, the AEPD, held that automatically refusing to disclose the identity of persons who accessed medical records was incompatible with the enhanced transparency required in the healthcare context, in violation of Article 15 GDPR. It ordered the controller to grant access or provide a properly reasoned refusal. Read more or edit on GDPRhub… https://gdprhub.eu/index.php?t...

Takeaway:

We have seen similar situations where the local Data Protection Authority decided the opposite. So we guess it is a case by case interpretation. Also, there might be a history of facts which happened to the employee that are not disclosed in this article, but explain the decision of the AEPD.

Sweden:

Fact:

Sweden's data protection authority, the Integritetsskyddsmyndigheten ('IMY'), issued a SEK1.8 million (159 480 euros) fine to medical IT solutions provider Miljödata i Karlskrona following an investigation into a 2025 data breach. The investigation reportedly found a hacker accessed an internal system and stole sensitive personally identifiable information of 2.2 million people. The IMY said the company did not implement commensurate data protection safeguards for the types of sensitive data it stored. Read more (in Swedish): https://www.imy.se/nyheter/san...

Takeaway:

Same as for the cyberattack at a French hospital abobe

United Kingdom:

Fact:

Grindr , the global LGBTQ networking app, agreed to pay 26 million GBP to settle a class-action lawsuit over claims the company violated the U.K. General Data Protection Regulation after allegedly sharing users' sensitive personal information, including whether they were HIV positive, with advertising companies, the Guardian reports. Grindr stated the alleged incident occurred during its 2020 merger with San Vicente Acquisition, noting it has worked to bolster its privacy standards and "remains a safe space for users, committed to transparency, user control and responsible data practices."
Full story

Takeaway:

Organisations cannot share personal data of people without informing them. And in the case of sensitive personal information like HIV test results, you need to obtain the consent of the persons.