Who Is the Attacker - Analyzing Data Protection Violations in Health Care

Every natural person has the fundamental right of protection in relation to the processing of their personal data. The General Data Protection Regulation (GDPR) is the legal basis for data protection in the European Union. One aspect of the GDPR is that violations of this regulation can lead to significant fines. To ensure data protection, controllers have to analyse and mitigate the risks to the rights and freedoms of data subjects. Many different stakeholders and organisations with or without malicious intentions can pose a risk in this sense. Overall, it is important to know who the attackers actually are and understand the context of potential violations. To this end we analyse data protection violations in the health care sector between July 2018 and March 2023 based on fines imposed under GDPR to identify stakeholders who pose a risk to the data subjects as well as their motives. Surprisingly, it appears that the controller is by far the most frequent perpetrator of a data protection violation while their motives are often just negligence. Insiders like employees often cause a personal data breach accidentally. Measures to enhance competence and awareness are of major importance to foster the compliance with data protection regulations.