DPA case 3895/83/22 – Violation Found (Finland, 2022)

The controller is a healtcare provider who requested the Finnish DPA to assess whether its planned system of processing patient data for scanning and prevention purposes would be compatible with the GDPR. Patients at risk to their health would be identified and referred to treatment through contact with the healthcare system. The patient population and medical records would be searched by a computer in order to identify patients at risk. The objectives of the approach would be to improve the health and well-being of individuals, prevent the onset and progression of diseases and improve equity in the health system. The Finnish DPA assessed the data processing operations involved, in particular the risk of automated decision-making and valid legal basis for processing sensitive data. First, the Finnish DPA assessed whether the envisaged processing of personal data would lead to automated individual decisions within the meaning of Article 22 GDPR. It distinguished between two instances: cases where patients would be selected for further examination on the basis of a risk assessment and patients who would not be selected after the risk assessment. For the first group, the result of the profiling would be taken into account only as one element of the decision-making process. The final decision would be taken by a trained person. Therefore, there would be human intervention in accordance with Article 22(3) GDPR. However, for the second group no further assessment by a competent person would be made. Hence, the DPA evaluated whether the profiling would produce legal or similarly significant effects to the patients who were rejected. It concluded that not being admitted to medical treatment could have significant adverse effects on the health of individuals. Accordingly, the envisaged processing would involve individual automated decisions prohibited under Article 22(1) GDPR. Second, the DPA looked at the legal basis the controller put forward for the processing of healt