The Finnish Motor Insurers' Centre – €52,000 Fine (Finland, 2021)

The Finnish DPA was notified that the Finnish Motor Insurers' Centre (the controller) had requested unnecessary patient information from healthcare providers in order to settle claims. The DPA then asked the controller to explain how it processed patient information disclosed by healthcare providers for the purposes of settling claims. In response to the request, the controller clarified that, according to [https://www.finlex.fi/fi/laki/ajantasa/2016/20160460#L7P82 Section 82 of the Finnish Motor Liability Insurance Act], it has the right, notwithstanding the obligation of confidentiality or other restrictions on access to information, to obtain statements made by healthcare providers and other information concerning the patients' medical records, health status, ability to work, treatment and rehabilitation. The controller stated that it was impossible to process the claim without the claimants' medical records. The controller processed the patients' healthcare appointment data to determine whether the healthcare provider had charged for visits that were not related to the examination or treatment of injuries sustained in a traffic accident. The controller emphasised that it followed the principle of data minimisation and that the patients’ healthcare appointment data were not requested unnecessarily. The controller also noted that it had to request a large amount of information in case the healthcare providers had omitted information necessary for claims handling. On the basis of the information provided by the controller, the DPA considered that [https://www.finlex.fi/fi/laki/ajantasa/2016/20160460#L7P82 Section 82 of the Finnish Motor Liability Insurance Act] does not give the controller the right to directly access all patient records, but that the information requested must be necessary for the settlement of the claim. As a general rule, insurance companies may not request all information about customers' healthcare appointments, but this information must be limited and specified on a case-by-case basis. The DPA emphasised that, in addition to the necessity requirement under the Finnish Motor Liability Insurance Act, the controller must also comply with the data minimisation principle as well as data protection by design and default when receiving personal data. Accordingly, the controller should have reasonably limited the information requested, erased unnecessary information disclosed to it and ensured that it processed only personal data necessary for the purposes of the processing. The DPA found that the processing of all information about the patients' healthcare appointments also failed to meet the fairness requirements for the processing of personal data, as the data subjects have a justified reason to expect that the insurance companies will only process the information necessary to settle the claim. The DPA also noted that although it is the healthcare provider's responsibility to sort the information to be disclosed, insurance companies must still review all the information they receive and erase any unnecessary personal data. However, billing issues between healthcare providers and insurance companies must be resolved by means other than the systematic and large-scale collection of patient information. On the basis of the information gathered, the DPA held that the controller had violated Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 25(2) GDPR. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA also ordered the controller to comply with the principles of fairness and data minimisation as well as data protection by design and default when processing the patient information. In addition to the reprimand and the order, the Sanctions Board of the DPA imposed an administrative fine of €52,000 on the controller pursuant to Article 83 GDPR. The Board considered that the controller's practice was intentional, and that it had not taken action to mitigate the damage suffered by data subjects.