DPA case 5546/163/2019 – Violation Found (Finland, 2022)

In 2019, the Finnish DPA had asked a healthcare provider (the controller) to explain how its online appointment booking system worked. In response to the request, the controller clarified that a user had to log in to the booking system with their name and personal identity code. The system had compared the information provided by the user against the information stored in the controller's patient information system. The user had been instructed to check the login information if it did not match the information in the patient information system. The controller acknowledged that, under certain conditions, the online appointment booking service could have been used to determine the complete personal identity code of a data subject by using brute force technique. The controller considered that this could have been prevented by limiting the retries of incorrectly entered login information. The controller also stated that it was able to investigate possible misuse by examining the log data collected from the service. The controller was aware that the personal identity code may often be known to people other than the data subject. However, the controller had assessed the overall risks to be low or moderate in terms of likelihood and severity. In 2020, the controller had submitted a data breach notification to the DPA, according to which the controller's online appointment booking system had been targeted by phishing. The phishing had come to light as a result of a blackmail message received by the controller, which revealed that a third party had obtained personal identity codes through the system. Following the breach, the controller had switched to strong electronic identification in its system. The DPA stated that the controller had failed to ensure the continuous confidentiality of the online appointment booking system. It had been possible to use the system to determine the complete personal identity code and a third party had also gained access to personal identity