- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Medical clinic – €5,000 Fine (Finland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A medical clinic in Finland was fined €5,000 for not giving a customer access to their medical records. The clinic also failed to properly inform clients about how their personal data was being used. This case highlights the importance of transparency in handling patient information.
What happened
The clinic did not provide a customer access to their medical records after a request and failed to inform clients about data processing.
Who was affected
Patients who requested access to their medical records and were not informed about data processing were affected.
What the authority found
The Finnish Data Protection Authority found that the clinic violated GDPR requirements for transparency and access to personal data.
Why this matters
This ruling emphasizes that healthcare providers must clearly communicate how they handle personal data. Clinics should ensure they have proper procedures in place for patient data access.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 15 March 2026.
Processing notes: articles corrected, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA has fined a medical clinic EUR 5,000. A customer of the clinic had complained to the DPA that he had not received access to his medical records from the clinic following a request for information. In addition, the clinic failed to adequately inform its clients about the processing of personal data. Specifically, the DPA points out that the clinic did not inform its clients about the extent to which it was acting as a data controller for patient data generated by its activities.
Related Enforcement Actions (0)
No other enforcement actions found for Medical clinic in FI
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
26 December 2021
Authority
Tietosuojavaltuutetun toimisto
Fine Amount
€5,000
About this data
Cite as: Cookie Fines. Medical clinic - Finland (2021). Retrieved from cookiefines.eu
Last updated: