DPA case 6132/151/19 – Complaint Upheld (Finland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Finnish hospital was found to have improperly charged a patient for access to their medical records. This matters because it reinforces the right of patients to access their data without unnecessary fees.
What happened
A patient requested a complete copy of their medical file but was charged 25 EUR for missing data.
Who was affected
A hospital patient who sought access to their medical records.
What the authority found
The Finnish Data Protection Authority stated that patients should generally receive their data free of charge, except for reasonable fees for additional copies.
Why this matters
This case emphasizes that healthcare providers must ensure patients can access their full medical records without extra charges. Hospitals should review their policies on data access fees.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A patient in a hospital (the Complainant) made an access request on the basis of Article 15 GDPR in order to obtain a copy of his medical file. The hospital provided him with a file containing only part of his health data. In particular, some X-rays and magnetic resonance images were missing. When the Complainant requested a copy of the missing data, he was charged a fee of 25 EUR by the hospital. The Complainant therefore filed a complaint with the Finnish DPA, asking whether these data should have not been provided to him free of charge on the basis of Article 15(3) GDPR. The Finnish DPA requested the hospital to provide its opinion on the matter, and in particular on the fee of 25 EUR. The hospital explained that X-rays and magnetic resonance images cannot be printed on paper, but had to be burned on a CD/DVD. According to the hospital, the fee of 25 EUR was reflecting the costs of the CD/DVD, secretarial work, as well as billing and postage. The hospital further referred to an opinion issued by the Finnish DPA in 2008 regarding the possibility to charge a reasonable fee to the data subject based on administrative costs (Opinion n°2546/41/2008). The Finnish DPA examined Article 15(3) GDPR, according to which data subjects should normally be provided with a copy of their data free of charge, unless further copies are requested, in which case "the controller may charge a reasonable fee based on administrative costs." The Finnish DPA appreciated this obligation to provide data subjects with a copy of their personal data free of charge in light of the principle of privacy by design (Article 25(1) GDPR). According to this principle, data protection issues should be taken into account by controllers from the outset when designing information systems . In practice, this presupposes that controllers should design or adapt their processing practices and technical capacity to ensure the respect of the right of data subjects to obtain a copy of their data free of charge u
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 6132/151/19 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 6132/151/19 - Finland (2021). Retrieved from cookiefines.eu
Last updated: