Cybersecurity Policy Report, Peruvian Clinic Fined Over Breach of Pop Star’s Medical Information, (Jul 7, 2025)

By Tony Foley

Peru’s National Superintendency of Health (SUSALUD) has imposed an administrative sanction of 668,750 soles ($187,600) against Delgado-Auna Clinic for disclosing the personal health data of pop star Shakira collected during her time there as a patient in February.

The SUSALUD news release is available only in Spanish, but a machine translation revealed the agency’s conclusion that data was disclosed and that any disclosure of health data of patients constituted a serious offense. SUSALUD emphasized that all users of health services, regardless of their nationality, insurance, and the type of establishment in which they receive care, had the right to be treated with respect for their dignity and privacy, with the guarantees of confidentiality and protection of data related to their care.

SUSALUD explained that protection of health data included information about a patient’s diagnosis, treatment, and medical condition, adding that such information should not be disclosed without the consent of the patient, their legal guardian, or their legal representative. This right is guaranteed by the Peruvian Constitution, the General Health Law, and the Law Establishing the Rights of Health Service Users. Finally, SUSALUD found that the Personal Data Protection Law regulated the proper handling of sensitive personal data related to a person’s health and established a consent requirement prior to disclosure.

News: InternationalLegislation LitigationEnforcement DataPrivacy