[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnY_UM1hPGAez511HxGXxS4exiz5kslP-rBa_-HaV59M":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"fbf50f4f-f055-4cb5-a587-6655597d35d7","Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F303\u002F2022","tietosuojavaltuutetun-toimisto-finland-tsv-303-2022-c145f8","Created page with \"{{DPAdecisionBOX |Jurisdiction=Finland |DPA-BG-Color= |DPAlogo=LogoFI.png |DPA_Abbrevation=Tietosuojavaltuutetun toimisto |DPA_With_Country=Tietosuojavaltuutetun toimisto (Finland) |Case_Number_Name=TSV\u002F303\u002F2022 |ECLI= |Original_Source_Name_1=Finlex |Original_Source_Link_1=https:\u002F\u002Fwww.finlex.fi\u002Ffi\u002Fviranomaiset\u002Ftietosuojavaltuutettu\u002F2026\u002F32#OT0_OT0 |Original_Source_Language_1=Finnish |Original_Source_Language__Code_1=FI |Original_Source_Name_2= |Original_Source_Link...\" Show changes","Finland's Data Protection Authority (Tietosuojavaltuutetun toimisto) has fined a healthcare services provider €33,000 for unlawfully disclosing personal data of customers' therapy appointments to Google, Meta, and Microsoft. The investigation revealed that sensitive health data, including appointment details and IP addresses, was shared with these tech giants via HTTP requests, violating GDPR articles related to data processing, security, and integrity. The company cited an employee error for the extensive disclosure but acknowledged the breach.","Finland's DPA fines healthcare provider €33,000 for unlawful data disclosure to Google, Meta, Microsoft.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV\u002F303\u002F2022&diff=53372&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FLogoFI.png","2026-10-12T12:22:05+00:00","2026-10-12T14:00:12.733835+00:00",7,[17,20,22,24,27],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Meta",{"name":23,"type":19},"Microsoft",{"name":25,"type":26},"GDPR","product",{"name":28,"type":19},"Mindemo Oy","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":29,"icon":31,"name":32,"slug":33},null,"Privacy Fines","privacy-fines",[35,39,44],{"category":36},{"id":37,"icon":31,"name":25,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":40},{"id":41,"icon":31,"name":42,"slug":43},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":45},{"id":29,"icon":31,"name":32,"slug":33},[],[18,23,21],{"controls":49,"vendors":132},[50,79,107],{"slug":51,"name":52,"problem":53,"products":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":80,"name":81,"problem":82,"products":83},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[84,91,99],{"vendor_slug":85,"vendor_name":23,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":108,"name":109,"problem":110,"products":111},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[112,118,125],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":122,"url":123,"description":124},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":108,"product_name":129,"url":130,"description":131},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":153},"finnish-healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft","Finnish Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft","A Finnish healthcare provider inadvertently transmitted sensitive patient data — including therapy appointment details and IP addresses — to third-party ad-tech platforms (Google, Meta, Microsoft) via HTTP tracking requests, likely embedded in website analytics or marketing pixels. The root cause was an employee misconfiguration or oversight when implementing third-party scripts, without adequate review of what data those scripts would collect and transmit. This violates GDPR's core principles of data minimisation, purpose limitation, and integrity, which are especially critical when handling special-category health data. The incident highlights that even well-intentioned digital marketing tools can become serious compliance and privacy risks if deployed without proper vetting and technical controls. Organisations handling sensitive health information must treat every third-party script as a potential data pipeline and govern them accordingly.",[138,139,140,141,142,143,144,145,146,147,148,149,150,151,152],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 SI-12 – Information Management and Retention","NIST SP 800-53 AC-20 – Use of External Information Systems","NIST SP 800-53 SA-9 – External Information System Services","CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 13 – Data Protection","CIS Control 16 – Application Software Security","ISO\u002FIEC 27001:2022 A.8.25 – Secure development life cycle","ITIL – Service Configuration Management (third-party tooling governance)",{}]