[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEAU8tiUi3iabxvUuJh8QJV8GTuHPBeFVKNaRq8uzw2U":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"eaa65022-9ac0-4b4d-9c88-091c9ed6a6d7","Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F303\u002F2022","tietosuojavaltuutetun-toimisto-finland-tsv-303-2022-29610e","Facts ← Older revision Revision as of 12:55, 12 October 2026 (One intermediate revision by the same user not shown) Line 105: Line 105: === Facts === === Facts === The DPA received a complaint about the online appointment booking service of a healthcare services provider (the controller) in November 2022. According to the complaint, the controller had disclosed personal data of the users of its website (the data subjects) to external tracking service providers. The DPA received a complaint about an online appointment booking service of a healthcare services provider (the controller) in November 2022. According to the complaint, the controller had disclosed personal data of the users of its website (the data subjects) to external tracking service providers. A technical report following a DPA investigation into the website revealed that the controller had disclosed data subjects’ therapy appointment booking data and online identification data to Google, Meta, and Microsoft via HTTP requests. The booking data disclosed included information on which type of appointment the user searched for, the therapist selected, and the location of the appointment. The online identification data consisted of technical device identifiers and metadata related to browser functionality, such as device type, screen characteristics, browser version information, and IP address. The controller stated that it had transferred data to external tracking service providers in accordance with the report. It acknowledged that information concerning appointment scheduling should not have been disclosed to external tracking service providers and pointed out that an error caused by a single employee had led to the extensive disclosure of personal data. However, patient data (such as information on mental health disorders and diagnoses) had only been processed within the controller’s own patient information systems. The controller had subsequently requested the tracking service providers to delete all data they had processed on behalf of the controller through the controller’s website. A technical report following a DPA investigation into the website revealed that the controller had disclosed data subjects’ therapy appointment booking data and online identification data to Google, Meta, and Microsoft via HTTP requests. The booking data disclosed included information on which type of appointment the user searched for, the therapist selected, and the location of the appointment. The online identification data consisted of technical device identifiers and metadata related to browser functionality, such as device type, screen characteristics, browser version information, and IP address. The data was only disclosed to these recipients if the user had accepted cookies on the website. The controller stated that it had transferred data to external tracking service providers in accordance with the report. It acknowledged that information concerning appointment scheduling should not have been disclosed to external tracking service providers and pointed out that an error caused by a single employee had led to the extensive disclosure of personal data. However, patient data (such as information on mental health conditions and diagnoses) had only been processed within the controller’s own patient information systems. The controller had subsequently requested the tracking service providers to delete all data they had processed on behalf of the controller through the controller’s website. === Holding === === Holding === The DPA issued the controller a fine of €33,000 for violations of Articles 5(1)(f), 25(1) and (2), as well as 32(1) and (2) GDPR. The DPA issued the controller a fine of €33,000 for violations of [[Article 5 GDPR|Articles 5(1)(f)]], [[Article 25 GDPR|25(1)]] and [[Article 25 GDPR|(2)]], as well as [[Article 32 GDPR|32(1)]] and [[Article 32 GDPR|(2)]] GDPR. It also reprimanded the controller for these GDPR infringements. First, the DPA held that the data disclosed by the controller contained personal data: it was reasonably possible for Google, Meta, and Microsoft to combine the IP address and device information they received from the controller with their own users’ data and thereby identify users in a situation where users had accepted the use of cookies in their browser and were registered with Google, Meta, or Microsoft services, or had used those services on their devices while logged in. Furthermore, information regarding therapy appointments constituted health data within the meaning of Articles 4(15) and 9 GDPR. First, the DPA held that the data disclosed by the controller contained personal data: it was reasonably possible for Google, Meta, and Microsoft to combine the IP address and device information they received from the controller with their own users’ data and thereby identify users in a situation where users had accepted the use of cookies in their browser and were registered with Google, Meta, or Microsoft services, or had used those services on their devices while logged in. Furthermore, information regarding therapy appointments constituted health data within the meaning of [[Article 4 GDPR|Articles 4(15)]] and [[Article 9 GDPR|9 GDPR]]. Second, the DPA found that the controller had violated Articles 32(1) and (2) GDPR. According to the DPA, the controller had failed to take into account that the processing involved health data and therefore posed a high risk for the data subjects when implementing technical and organisational measures. In addition, the controller had not used pseudonymisation, anonymisation, or other protective measures before disclosing the personal data to tracking service providers. Second, the DPA found that the controller had violated [[Article 32 GDPR|Articles 32(1)]] and [[Article 32 GDPR|(2) GDPR]]. According to the DPA, the controller had failed to take into account that the processing involved health data and therefore posed a high risk for the data subjects when implementing technical and organisational measures. In addition, the controller had not used pseudonymisation, anonymisation, or other protective measures before disclosing the personal data to tracking service providers. Finally, the DPA held that the controller had also infringed the principles of integrity and confidentiality enshrined in [[Article 5 GDPR|Article 5(1)(f) GDPR]] and failed to meet the requirements for data protection by design and default set forth in Articles 25(1) and (2) GDPR. The DPA noted that a single employee could not be blamed for the failure to comply with the controller's duties. In the same vein, the data subjects' consent to cookies or acceptance of personalised ads could not relieve the controller of its duties under the GDPR. Finally, the DPA held that the controller had also infringed the principles of integrity and confidentiality enshrined in [[Article 5 GDPR|Article 5(1)(f) GDPR]] and failed to meet the requirements for data protection by design and default set forth in [[Article 25 GDPR|Articles 25(1)]] and [[Article 25 GDPR|(2) GDPR]]. The DPA noted that a single employee could not be blamed for the failure to comply with the controller's duties. In the same vein, the data subjects' consent to cookies or acceptance of personalised ads could not relieve the controller of its duties under the GDPR. == Comment == == Comment ==","Finland's Data Protection Authority (DPA) has fined a healthcare provider €33,000 for violating GDPR. The provider disclosed users' therapy appointment booking data and online identification data to Google, Meta, and Microsoft without proper safeguards. While patient diagnoses remained internal, the DPA found that sharing appointment details and technical identifiers constituted a breach of data protection principles, especially concerning sensitive health data.","Finland's DPA fines healthcare provider €33,000 for GDPR violations related to data sharing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV\u002F303\u002F2022&diff=53374&oldid=53372","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FLogoFI.png","2026-10-12T12:55:35+00:00","2026-10-12T14:00:12.733835+00:00",7,[17,20,22],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Meta",{"name":23,"type":19},"Microsoft","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":24,"icon":26,"name":27,"slug":28},null,"Policy","policy",[30,35,40],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":41},{"id":24,"icon":26,"name":27,"slug":28},[],[18,23,21],{"controls":45,"vendors":126},[46,75,98],{"slug":47,"name":48,"problem":49,"products":50},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":76,"name":77,"problem":78,"products":79},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[80,85,92],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":81,"product_name":82,"url":83,"description":84},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":87,"url":90,"description":91},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":93,"product_name":94,"url":96,"description":97},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"slug":99,"name":100,"problem":101,"products":102},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[103,110,118],{"vendor_slug":104,"vendor_name":23,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":143},"finnish-healthcare-provider-fined-33k-for-sharing-patient-data-with-big-tech-via-tracking-tools","Finnish Healthcare Provider Fined €33K for Sharing Patient Data with Big Tech via Tracking Tools","The healthcare provider inadvertently disclosed sensitive health-related data — including therapy appointment bookings and online identifiers — to third-party platforms (Google, Meta, Microsoft) through tracking pixels and analytics tools embedded in their website or booking system. This represents a failure to assess and control what data third-party scripts collect and transmit, particularly when handling special category data under GDPR Article 9. The core issue is that convenience-driven technology integrations were deployed without adequate data protection impact assessments or legal bases for sharing. This matters because even technical identifiers combined with appointment context can reveal sensitive health information, exposing patients to profiling risks. Organizations handling health data carry an elevated duty of care and cannot rely on default vendor configurations as sufficient safeguards.",[132,133,134,135,136,137,138,139,140,141,142],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 28 – Processor obligations and Data Processing Agreements","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 SA-9 – External Information System Services","NIST SP 800-53 PT-7 – Specific Categories of Personally Identifiable Information","NIST Privacy Framework PR.PO-P1 – Policies and procedures for data processing","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27701 – Privacy Information Management (extension to ISO 27001)",{}]