- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Company – €122,000 Fine (Finland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A company processing health data was fined EUR 122,000 for not having proper consent from users. The DPA found that the company did not inform users adequately about how their health data would be used. This ruling stresses the importance of clear communication and consent in data processing.
What happened
The company failed to provide specific information about the processing of various types of health data.
Who was affected
Users of the company's products that process health data, such as heart rate and body mass index.
What the authority found
The Finnish DPA determined that the company did not have valid consent for processing health data, violating GDPR requirements.
Why this matters
This case serves as a warning to companies that they must clearly communicate how they use personal data and obtain informed consent. It underscores the importance of transparency in data handling.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 6 March 2026.
Processing notes: articles corrected, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA has imposed a fine of EUR 122,000 on a company with products that process health data, such as heart rate, etc. The DPA had received several complaints regarding the processing of health data from data subjects. During its investigation, the DPA found that the company did not have a sufficient legal basis to process various types of health data. While the company had informed users of the products about the processing of personal health data in general, it had failed to provide information for each of the different types of health data (e.g., body mass index or oxygen capacity), such as the purpose of the processing. Accordingly, the DPA found that the users' consent could not be valid since it was not given on an individual basis and with full knowledge of the facts.
Related Enforcement Actions (0)
No other enforcement actions found for Company in FI
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
27 December 2022
Authority
Tietosuojavaltuutetun toimisto
Fine Amount
€122,000
About this data
Cite as: Cookie Fines. Company - Finland (2022). Retrieved from cookiefines.eu
Last updated: