- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 6745/163/18 – Complaint Upheld (Finland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A healthcare organization in Finland kept patient data for three months to help healthcare professionals learn from their treatment results. The Finnish Data Protection Authority found this practice didn't meet legal requirements because it wasn't considered necessary for patient care. This decision highlights the importance of using patient data only for direct care purposes.
What happened
The healthcare organization processed patient data for professional development without a valid legal basis.
Who was affected
Patients whose health data was kept for analysis after their treatment.
What the authority found
The Finnish DPA ruled that the processing of patient data for professional development does not qualify as necessary for patient care under the law.
Why this matters
This ruling emphasizes that healthcare organizations must ensure they have proper legal grounds for processing patient data. It serves as a reminder for similar organizations to review their data handling practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A healthcare organization had put a system in place whereby personal data relating to patients were kept for a period of 3 months after treatment of the patients, so that the healthcare professionals who had treated the patients in question could analyze the results and gain experience from it. The health data of identified patients was therefore kept and processed for the purpose of the professional development of healthcare professionals. Having been informed about the situation, the Finnish DPA decided to analyse whether the GDPR, read in combination with the relevant national law on patients rights, would allow the processing of patient data for the purpose of the professional development of a healthcare professional. After analyzing the relevant provisions of national law, including the Act on the Status and Rights of Patients 1992/785 (hereafter, the Patients Act), the Finnish DPA found that the processing of patient data is normally allowed for primary use only. This primary use must involve 'patient care', such as when a healthcare professional is processing patient data for the treatment of the patient in question, or for related tasks. The Finnish DPA found however that the processing of patient data for the purpose of the professional development of healthcare professionals cannot be considered as 'patient care' within the meaning of the Patients Act. Neither can it be considered as a task related to patient care, since the healthcare professional would use the data for his/her own development, but would not in any way determine, restore or maintain the health of the patient in question. The Finnish DPA also considered the fact that, according to Article 9(2)(g) GDPR, the processing of health data is allowed when "necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measure
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 6745/163/18 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 6745/163/18 - Finland (2021). Retrieved from cookiefines.eu
Last updated: