DPA case 6482/186/2020 – Violation Found (Finland, 2022)

A healthcare provider (controller) requested a prior consultation from the DPA in line with Article 36 GDPR regarding its new Health Benefit Analysis tool. The system was designed to improve the preventive and proactive approach to healthcare by using algorithms to identify patients with health risks. After this, a healthcare professional would assess the need for treatment. To assess the legality of the planned processing of personal data, the DPA decided to handle the case not as a prior consultation but as supervision. The DPA considered in particular whether using the Health Benefit Analysis tool for patients would constitute automated individual decision-making under Article 22 GDPR. The DPA held that patients identified by the system for further examination would not be subject to a decision based solely on automated processing. Instead, the healthcare professionals would make a final assessment considering other factors besides the system recommendation. However, for patients not selected by the system, the decision would be final and solely based on automated processing. Furthermore, it would significantly affect them because they would be deprived of the opportunity to receive a healthcare service. Therefore, the DPA issued a warning to the controller under Article 58(2)(a) GDPR as the envisioned processing would violate Article 22 GDPR.