Finnish Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft
A Finnish healthcare provider inadvertently transmitted sensitive patient data — including therapy appointment details and IP addresses — to third-party ad-tech platforms (Google, Meta, Microsoft) via HTTP tracking requests, likely embedded in website analytics or marketing pixels. The root cause was an employee misconfiguration or oversight when implementing third-party scripts, without adequate review of what data those scripts would collect and transmit. This violates GDPR's core principles of data minimisation, purpose limitation, and integrity, which are especially critical when handling special-category health data. The incident highlights that even well-intentioned digital marketing tools can become serious compliance and privacy risks if deployed without proper vetting and technical controls. Organisations handling sensitive health information must treat every third-party script as a potential data pipeline and govern them accordingly.
Tactical Insight
Immediate actions
- Audit all third-party scripts, tracking pixels, and analytics tags currently active on patient-facing web properties and remove any not explicitly approved.
- Implement a Content Security Policy (CSP) and tag management governance process to block unauthorised data transmissions to external domains.
Long-term improvements
- Establish a formal Data Protection Impact Assessment (DPIA) process that must be completed before any third-party tool is deployed on systems handling health or sensitive personal data.
- Train all staff involved in website management, marketing, and IT on GDPR obligations for special-category data and the risks of third-party integrations.
- Enforce data minimisation by design: configure analytics and marketing platforms to explicitly exclude health-related parameters, appointment data, and identifiers.
Detection & monitoring measures
- Deploy network traffic monitoring and data loss prevention (DLP) tools to alert on outbound HTTP requests carrying personal or health-related data to unexpected third-party endpoints.
- Conduct periodic third-party risk reviews and cookie/tracker audits (e.g., using tools like Blacklight or similar) to continuously verify compliance of web properties.