Tietosuojavaltuutetun toimisto (Finland) - TSV/303/2022
Finland's DPA fines healthcare provider €33,000 for GDPR violations related to data sharing.
Run Google?
Get an email when a reviewed story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Finland's Data Protection Authority (DPA) has fined a healthcare provider €33,000 for violating GDPR. The provider disclosed users' therapy appointment booking data and online identification data to Google, Meta, and Microsoft without proper safeguards. While patient diagnoses remained internal, the DPA found that sharing appointment details and technical identifiers constituted a breach of data protection principles, especially concerning sensitive health data.
The lesson from this incident
Full lessonThe healthcare provider inadvertently disclosed sensitive health-related data — including therapy appointment bookings and online identifiers — to third-party platforms (Google, Meta, Microsoft) through tracking pixels and analytics tools embedded in their website or booking system. This represents a failure to assess and control what data third-party scripts collect and transmit, particularly when handling special category data under GDPR Article 9. The core issue is that convenience-driven technology integrations were deployed without adequate data protection impact assessments or legal bases for sharing. This matters because even technical identifiers combined with appointment context can reveal sensitive health information, exposing patients to profiling risks. Organizations handling health data carry an elevated duty of care and cannot rely on default vendor configurations as sufficient safeguards.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.