The Personal Data Protection Board (“Board”) rendered a decision dated 20.04.2021 and numbered 2021/407 (“Decision”) regarding the data breach notice of a data controller hospital (“Data Controller”).
In the Decision, within the scope of the data breach notice submitted by the Data Controller, it was stated that (i) the breach was carried out with the instruction of the physician working in the hospital, by removing the files of the patients out of the hospital by the hospital staff; (ii) the employee who attempted to extract the file was detected 17 days after it was videotaped; (iii) all but one of the employees involved in the breach was given a training on protection of personal data prior to occurrence of the data breach; (iv) the Personal Data Protection Authority (“Authority”) was notified to the Board 25 days after the breach occurred, due to the reasons included in the breach notification regarding late notification.