- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Lääkäriklinikka Estetic Oy – Court Ruling (Finland, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Finnish court upheld a decision against Lääkäriklinikka Estetic Oy for not fulfilling a patient's access request for personal data. The clinic argued it did not have the records, but the court found it was responsible for the data generated during treatment. This case emphasizes the importance of transparency in patient data handling.
What happened
Lääkäriklinikka Estetic Oy failed to properly respond to a patient's request for access to their personal data.
Who was affected
A patient who received treatment at Lääkäriklinikka Estetic Oy and requested access to their personal data.
What the authority found
The court agreed with the Finnish DPA that the clinic violated GDPR by not informing the patient about the handling of their personal data.
Why this matters
This ruling highlights the responsibility of healthcare providers to ensure patients can access their data. Other clinics should review their protocols for handling patient data requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 22 March 2026.
Processing notes: amount discrepancy, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller (Lääkäriklinikka Estetic Oy, a medical clinic) had asked the Administrative Court of Helsinki (the Court) to overturn the €5,000 administrative fine imposed by the Finnish DPA and the DPA's decision, according to which the controller had not implemented the data subject's access request. The controller filed the appeal claiming that it had already fulfilled the data subject's access request as far as it concerned the personal data it processed. The controller emphasised that it did not have access to the patient records of another company whose surgeon had treated the data subject at the controller's premises. The controller argued that the DPA should have requested an explanation from the other company as well, because the data subject was not a patient of the controller, but a patient of the other company. The controller also stated that the DPA's actions had not been based on a sufficient and appropriate investigation. The DPA emphasised that the data subject had received treatment from the controller at the controller's premises and that the controller had not informed the data subject that their patient records are in the possession of another company. The DPA also stated that the controller had not instructed the data subject to request their personal data from another company or otherwise informed the data subject about the matters related to the controllership of their personal data. The Court noted that, despite the opportunity reserved for it, the controller had not sufficiently demonstrated that some other entity had acted as a controller of the personal data generated in connection with the treatment that took place on its premises. In its appeal, the controller had not denied that the data subject had received treatment from the controller. Thus, the Court stated that the controller had to be considered as a controller within the meaning of the GDPR. In light of this, the Court agreed with the DPA that the controller had violated Articl
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (1)
Other cases involving Lääkäriklinikka Estetic Oy in FI
Details
Ruling Date
16 June 2023
Authority
DPA Tietosuojavaltuutetu
About this data
Cite as: Cookie Fines. Lääkäriklinikka Estetic Oy - Finland (2023). Retrieved from cookiefines.eu
Last updated: