Psykoterapiakeskus Vastaamo Oy – €608,000 Fine (Finland, 2021)

The psychotherapy firm 'Vastaamo Oy's' (hereafter, the Firm) experienced two data breaches in November 2018 and March 2019, where its patient records were hacked by a third party (the attacker). During an investigation conducted by the Finnish DPA, it was found that the Firm had become aware of (at least) the latter data breach at the time it happened. The breaches were not reported to the Finnish DPA until late September 2020, shortly after the Firm had been subject to blackmail by the attacker. The following months, at least 15,000 patients were also blackmailed. In particular, the attacker tried to obtain monetary advantages from them by threatening to publish their personal patients records, and around 300 records were actually leaked online on the Tor network. Following this affair, the Firm suffered financially and was ultimately declared bankrupt by the District Court of Helsinki in February 2021. The Finnish DPA found that the firm had violated Articles 33(1) GDPR (notification of data breaches to the DPA) and Article 34(1) GDPR (communication of data breaches to data subjects) for having failed to report in due time the data breaches to the Finnish DPA and to the data subjects, respectively. Furthermore, the Finnish DPA found that Article 5(1)(f) GDPR had been violated because the Firm had failed to implement appropriate security measures to ensure the integrity and confidentiality of the personal data. The Finnish DPA also considered that the Firm had violated its security obligations under Articles 24(1), 25(1), 32(1) and 32(2) GDPR. Finally, the Finnish DPA considered that the firm had failed to respect the principle of accountability enshrined in Article 5(2) GDPR, as it could not demonstrate compliance with the core principles of the GDPR. The Sanctions Board of the Finnish DPA decided to impose a fine of €145,600 for infringement of Article 33(1) GDPR, a fine of €145,600 for infringement of Article 34(1) GDPR, and a fine of €316,800 for infringement of Article 5(1)(f) GDPR. In total, the administrative fine thus amounted to €608,000, representing around 4.2% of the Firm's turnover for the year 2020.