In its decision dated 2 June 2010, the Supreme Court, Third Division of Administrative Litigation, SECTION 6, upheld the 2005 fining by the Spanish Data Protection Agency (AEPD) of a private gynaecologic clinic after different patient medical records had been thrown away in the street.

As background to the present case, after 150 patient medical records from a private gynaecologic clinic were found in a waste container in a public thoroughfare and the event was published in the National Press, the AEPD initiated disciplinary proceedings on 4 March 2005 resulted in the clinic being fined € 300,506.05.

The ruling issued by the AEPD Director establishing the fine to be paid by the Clinic was appealed by the latter as it considered the penalty to be completely disproportionate. The appeal was fully rejected by the decision in question, which fully upheld the penalty imposed.

The Supreme Court found that the clinic had committed two infringements, each of which were interdependent. The first consisted of the breach of security measures required of an entity entrusted with processing personal data, which were particularly sensitive in this case. Second, the clinic had been in breach of its duty of secrecy. The Court therefore found the infraction to be very serious and that the penalty duly reflected that.

The sanctioned entity defended itself by claiming that the medical records had been deposited in the container by a third party. In any event, the Court considered that the liability of the clinic as a legal entity could not thus be avoided, particularly when person turned out to be an employee.

Finally, with regard to the clinic’s petition to the Court to moderate the fine imposed based on the principle of proportionality that it argued had been broken; the Court dismissed the claim as it found that the minimum penalty had been applied given all the circumstances. Thus Court therefore found that there were no grounds for the alleged breach of the principle of proportionality and upheld the fine of € 300,506.05 imposed on the entity.