- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 4022/171/22 – Violation Found (Finland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A healthcare provider reported a data breach after a CEO's bag, containing sensitive patient data, was stolen. The authority found that the provider did not adequately protect the data on the laptop, which was only password-protected but not encrypted. This ruling emphasizes the need for better data security measures.
What happened
A healthcare provider's laptop with patient data was stolen due to inadequate physical security measures.
Who was affected
Patients whose health data was stored on the stolen laptop and external hard drives.
What the authority found
The data protection authority ruled that the healthcare provider violated GDPR by failing to implement appropriate security measures to protect personal data.
Why this matters
This case highlights the importance of encrypting sensitive data and securing devices to prevent unauthorized access. Organizations must take stronger precautions to protect personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A healthcare provider (the controller) had submitted a data breach notification to the Finnish DPA, according to which the CEO had left their bag outside without supervision and the bag had been stolen. Inside the bag was a laptop, external hard drives and paper documents containing, among other things, patients' health data. The controller stated that the laptop was turned off and the login was protected with a password, but the laptop's mass storage or the personal data it contained had not been encrypted. The external hard drives contained backups of the controller's system, which were likely encrypted. On the basis of the information provided by the controller, the DPA considered that the password protection used by the controller had been a clearly inadequate method to protect the personal data stored on the laptop. If a third party gains a physical access to the device, the password does not prevent transferring the mass storage to another device and reading the content of the unencrypted mass storage on this other device. The DPA emphasised that accessing data on external hard drives may be even easier, for example by connecting the drive to a third-party device and viewing its contents. For this reason, especially high-risk personal data must be adequately protected and the devices containing that data must be stored carefully. The DPA stated that when paper documents end up in the possession of a third party, it has direct access to the information contained in the documents. Paper documents must be handled in such a way that they are not accessible to third parties, and they must not be taken outside without proper protection and supervision. On the basis of the information gathered, the DPA held that the controller had violated Article 32(1) GDPR and Article 32(2) GDPR by failing to comply with its obligation to implement appropriate technical and organisational measures, such as encryption, to prevent unauthorised access to personal data. The personal
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 4022/171/22 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 4022/171/22 - Finland (2022). Retrieved from cookiefines.eu
Last updated: