The CNIL, France's national data protection authority, has imposed a fine of €500,000 on Hôpital Privé de la Loire after a breach affecting health data, according to a notice published by the European Data Protection Board.
The case concerns the handling of health data, a special category of personal data under the GDPR that is subject to heightened protection requirements. Breaches involving this category typically draw close regulatory scrutiny because of the sensitivity of the information and the potential harm to patients if it is exposed or misused.
The published summary does not detail the specific circumstances of the breach, the number of individuals affected, or the exact grounds cited by the CNIL in setting the fine amount. Organisations following this case should look to the CNIL's own decision, once available, for the factual and legal basis of the penalty.
While this enforcement action falls under GDPR rather than the EU AI Act, it is a useful reminder for healthcare providers and other organisations processing sensitive personal data. Many AI systems used in healthcare settings, particularly those involving diagnosis, triage, or patient risk assessment, are likely to qualify as high-risk under the AI Act's Annex III and will also process substantial volumes of health data.
As a compliance matter, organisations deploying or preparing to deploy AI in healthcare should treat data protection safeguards and AI Act obligations as complementary rather than separate workstreams. Weaknesses in data security practices, of the kind that can lead to fines such as this one, may also undermine the risk management and data governance measures expected under the AI Act.
This case underscores the continued importance of robust data breach prevention and response procedures for any organisation handling health data, whether or not AI is directly involved in the processing.