- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case TSV/29/2020 – Violation Found (Finland, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Finnish hospital sent patients their test results via SMS, including personal identification numbers, which raised privacy concerns. The DPA questioned the necessity of including such sensitive information in text messages. This case highlights the importance of minimizing personal data sharing in communications.
What happened
A hospital sent SMS messages containing patients' personal identification numbers along with test results.
Who was affected
Patients who received SMS messages from the hospital containing their personal identification numbers.
What the authority found
The DPA found that including personal identification numbers in SMS messages was unnecessary and posed privacy risks.
Why this matters
This ruling emphasizes the need for healthcare providers to carefully consider the information they share in communications to protect patient privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that a hospital had sent test results to its patients by SMS, including the patient's personal identification number. The DPA then asked the controller to explain the purpose of including personal identification numbers in text messages. In response to the request, the controller clarified that its mobile service automatically sent test results, treatment instructions and a proposal for the next monitoring date to patients via SMS, for example, as follows: “[Patient ID]: [Test X] score is [Y] and everything is fine. Your next checkup is on [date]”. The controller stated that the inclusion of the personal identification number in the SMS ensured that the patient information was not inadvertently disclosed to the wrong persons with the same name. The controller considered that in a service where the personal identification number is transmitted as a text message to the patient's own mobile phone, the risk related to the processing of the personal identification number is estimated to be low. On the other hand, if the SMS is targeted to the wrong person, the risks for the data subject can be considerably high. On the basis of the information provided by the controller, the DPA noted that the purpose of [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P29 Section 29 of the Finnish Data Protection Act] is to protect the personal identification number and to prevent its unnecessary processing. In addition, according to [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P29 Section 29(4) of the Finnish Data Protection Act], the personal identification number should not be unnecessarily included in documents printed or created on the basis of a filing system. The DPA was of the opinion that SMS should be considered as such a document. The DPA emphasised that, in accordance with Article 87 GDPR, member states may determine specific conditions for the processing of a national identification number and in that case, the national ident
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/29/2020 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/29/2020 - Finland (2024). Retrieved from cookiefines.eu
Last updated: