Tietosuojavaltuutetun toimisto (Finland) - TSV/303/2022
Finland's DPA fines healthcare provider €33,000 for unlawful data disclosure to Google, Meta, Microsoft.
Run Google?
Get an email when a reviewed story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Finland's Data Protection Authority (Tietosuojavaltuutetun toimisto) has fined a healthcare services provider €33,000 for unlawfully disclosing personal data of customers' therapy appointments to Google, Meta, and Microsoft. The investigation revealed that sensitive health data, including appointment details and IP addresses, was shared with these tech giants via HTTP requests, violating GDPR articles related to data processing, security, and integrity. The company cited an employee error for the extensive disclosure but acknowledged the breach.
The lesson from this incident
Full lessonA Finnish healthcare provider inadvertently transmitted sensitive patient data — including therapy appointment details and IP addresses — to third-party ad-tech platforms (Google, Meta, Microsoft) via HTTP tracking requests, likely embedded in website analytics or marketing pixels. The root cause was an employee misconfiguration or oversight when implementing third-party scripts, without adequate review of what data those scripts would collect and transmit. This violates GDPR's core principles of data minimisation, purpose limitation, and integrity, which are especially critical when handling special-category health data. The incident highlights that even well-intentioned digital marketing tools can become serious compliance and privacy risks if deployed without proper vetting and technical controls. Organisations handling sensitive health information must treat every third-party script as a potential data pipeline and govern them accordingly.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.