[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXm0KyNh6J9oSghfY--FZM9KwK5uqVXWMEnc7VDQcmcE":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"b72e49c6-d5f5-42cf-8835-ca55ef6beca9","Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F303\u002F2022","tietosuojavaltuutetun-toimisto-finland-tsv-303-2022-ece029","← Older revision Revision as of 06:55, 14 October 2026 Line 100: Line 100: }} }} The DPA fined a healthcare services provider €33,000 for unlawfully disclosing personal data on customers' therapy appointments to Google, Meta, and Microsoft. The DPA fined a healthcare service provider €33,000 for unlawfully disclosing personal data on customers' therapy appointments to Google, Meta, and Microsoft due to external tracking on its website. == English Summary == == English Summary ==","Finland's data protection authority (Tietosuojavaltuutetun toimisto) fined healthcare services provider Mindemo Oy €33,000 for unlawfully disclosing personal data on customers' therapy appointments to Google, Meta, and Microsoft through external tracking pixels on its website. The controller transmitted therapy appointment booking data and device identifiers via HTTP requests without adequate safeguards, violating GDPR Articles 5(1)(f), 25(1), 25(2), 32(1), and 32(2). The DPA determined the disclosures constituted personal data processing failures in both data minimization and security-by-design obligations.","Finland DPA fines healthcare provider €33,000 for unlawful tracking pixel disclosure to Google, Meta, Microsoft","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV\u002F303\u002F2022&diff=53396&oldid=53374","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FLogoFI.png","2026-10-14T06:55:58+00:00","2026-10-14T08:00:20.115123+00:00",8,[17,20,22,24],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Meta",{"name":23,"type":19},"Microsoft",{"name":25,"type":26},"Mindemo Oy (formerly Heltti Oy) appointment booking service","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":27,"icon":29,"name":30,"slug":31},null,"GDPR","gdpr",[33,38,43,48],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":29,"name":51,"slug":52},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,23,21],{"controls":56,"vendors":137},[57,85,111],{"slug":58,"name":59,"problem":60,"products":61},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":79,"vendor_name":23,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":86,"name":87,"problem":88,"products":89},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":79,"vendor_name":23,"vendor_logo":80,"product_slug":107,"product_name":108,"url":109,"description":110},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":112,"name":113,"problem":114,"products":115},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[116,123,131],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":117,"product_name":120,"url":121,"description":122},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":133,"url":135,"description":136},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":155},"healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft-via-tracking-pixels","Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft via Tracking Pixels","Mindemo Oy unlawfully transmitted sensitive therapy appointment booking data to third-party advertising platforms (Google, Meta, Microsoft) through tracking pixels embedded on its website, without any adequate safeguards or legal basis. This violated core GDPR principles including data minimization, security-by-design, and confidentiality, exposing highly sensitive health-related information to commercial entities. The failure stems from deploying third-party marketing tools without assessing their data flows or implementing technical controls to prevent sensitive data from being included in HTTP requests. This case illustrates that off-the-shelf tracking tools are never privacy-safe by default, especially in sensitive healthcare contexts where the stakes of exposure are significantly higher. Organizations must treat third-party scripts as potential data processors and conduct proper due diligence before deployment.",[143,144,145,146,147,148,149,150,151,152,153,154],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 25(1) – Data protection by design","GDPR Article 25(2) – Data protection by default","GDPR Article 32(1) – Security of processing","GDPR Article 32(2) – Risk-appropriate technical measures","NIST SP 800-53 SA-9 – External Information System Services","NIST SP 800-53 SI-12 – Information Output Handling and Retention","NIST Privacy Framework PR.PO-P1 – Policies, Processes, and Procedures","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 12 – Network Infrastructure Management","ISO\u002FIEC 27001:2022 A.8.25 – Secure development life cycle","ITIL – Service Configuration Management (tracking third-party dependencies)",{}]