Tietosuojavaltuutetun toimisto (Finland) - TSV/303/2022
Finland DPA fines healthcare provider €33,000 for unlawful tracking pixel disclosure to Google, Meta, Microsoft
Run Google?
Get an email when a reviewed story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Finland's data protection authority (Tietosuojavaltuutetun toimisto) fined healthcare services provider Mindemo Oy €33,000 for unlawfully disclosing personal data on customers' therapy appointments to Google, Meta, and Microsoft through external tracking pixels on its website. The controller transmitted therapy appointment booking data and device identifiers via HTTP requests without adequate safeguards, violating GDPR Articles 5(1)(f), 25(1), 25(2), 32(1), and 32(2). The DPA determined the disclosures constituted personal data processing failures in both data minimization and security-by-design obligations.
The lesson from this incident
Full lessonMindemo Oy unlawfully transmitted sensitive therapy appointment booking data to third-party advertising platforms (Google, Meta, Microsoft) through tracking pixels embedded on its website, without any adequate safeguards or legal basis. This violated core GDPR principles including data minimization, security-by-design, and confidentiality, exposing highly sensitive health-related information to commercial entities. The failure stems from deploying third-party marketing tools without assessing their data flows or implementing technical controls to prevent sensitive data from being included in HTTP requests. This case illustrates that off-the-shelf tracking tools are never privacy-safe by default, especially in sensitive healthcare contexts where the stakes of exposure are significantly higher. Organizations must treat third-party scripts as potential data processors and conduct proper due diligence before deployment.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.