[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHsNhtqjVaLD_dux_A6-qcrb4kqGuzcq9TVtTHTOBcs4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":27,"status":28,"created_at":29,"published_at":30,"article":31,"tags":35,"podcasts":54,"controls":55},"dcc41126-1482-4f7d-9fe5-10bc2f304d27","finnish-healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft","fbf50f4f-f055-4cb5-a587-6655597d35d7","Finnish Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft","A Finnish healthcare provider inadvertently transmitted sensitive patient data — including therapy appointment details and IP addresses — to third-party ad-tech platforms (Google, Meta, Microsoft) via HTTP tracking requests, likely embedded in website analytics or marketing pixels. The root cause was an employee misconfiguration or oversight when implementing third-party scripts, without adequate review of what data those scripts would collect and transmit. This violates GDPR's core principles of data minimisation, purpose limitation, and integrity, which are especially critical when handling special-category health data. The incident highlights that even well-intentioned digital marketing tools can become serious compliance and privacy risks if deployed without proper vetting and technical controls. Organisations handling sensitive health information must treat every third-party script as a potential data pipeline and govern them accordingly.","**Immediate actions:**\n- Audit all third-party scripts, tracking pixels, and analytics tags currently active on patient-facing web properties and remove any not explicitly approved.\n- Implement a Content Security Policy (CSP) and tag management governance process to block unauthorised data transmissions to external domains.\n\n**Long-term improvements:**\n- Establish a formal Data Protection Impact Assessment (DPIA) process that must be completed before any third-party tool is deployed on systems handling health or sensitive personal data.\n- Train all staff involved in website management, marketing, and IT on GDPR obligations for special-category data and the risks of third-party integrations.\n- Enforce data minimisation by design: configure analytics and marketing platforms to explicitly exclude health-related parameters, appointment data, and identifiers.\n\n**Detection & monitoring measures:**\n- Deploy network traffic monitoring and data loss prevention (DLP) tools to alert on outbound HTTP requests carrying personal or health-related data to unexpected third-party endpoints.\n- Conduct periodic third-party risk reviews and cookie\u002Ftracker audits (e.g., using tools like Blacklight or similar) to continuously verify compliance of web properties.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 SI-12 – Information Management and Retention","NIST SP 800-53 AC-20 – Use of External Information Systems","NIST SP 800-53 SA-9 – External Information System Services","CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 13 – Data Protection","CIS Control 16 – Application Software Security","ISO\u002FIEC 27001:2022 A.8.25 – Secure development life cycle","ITIL – Service Configuration Management (third-party tooling governance)",{},"published","2026-10-12T14:21:55.554878+00:00","2026-10-12T14:21:55.533+00:00",{"id":7,"url":32,"slug":33,"title":34},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV\u002F303\u002F2022&diff=53372&oldid=0","tietosuojavaltuutetun-toimisto-finland-tsv-303-2022-c145f8","Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F303\u002F2022",[36,42,48],{"id":37,"name":38,"slug":39,"description":40,"color":41},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":49,"name":50,"slug":51,"description":52,"color":53},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[56,60,64],{"slug":57,"name":58,"problem":59},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":61,"name":62,"problem":63},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":65,"name":66,"problem":67},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]