Finnish SA: administrative fine on company for processing health information without an appropriate consent

27 January 2023

Background information

  • Date of final decision: 27 December 2022
  • Cross-border case, the decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS).
  • LSA: Finland
  • CSAs: Italy, Belgium, Czech Republic, France, Denmark,
  • Greece, Germany, Hungary, the Netherlands, Norway, Slovakia, Slovenia, Sweden,
  • Luxembourg, Spain and Poland
  • Legal Reference: Processing of special categories of personal data (Article 9(2)), Conditions for consent (Article 7(2) and Article 7(4))
  • Decision: Administrative fine, reprimand
  • Key words: Health data, consent

Summary of the Decision

 

Origin of the case

The Finnish SA investigated the company's practices based on complaints made in 2018–2019. The investigations revealed that the company did not have the consent required by the GDPR for processing data on body mass indices and maximal oxygen uptake.

Key Findings

The company had asked for consent to the processing of health data in general but had not specified which data it was collecting and processing. The consent requested did not meet the requirements of the GDPR as it was not specific and informed.

The SA finds that the controller had informed the data subjects of the processing of their personal data but had nevertheless not provided sufficient information on the types of personal data being processed and the purposes of processing each type.

The SA especially pointed out that the extensive processing of health data is part of the company's core business.

Decision

The Finnish SA imposed an administrative fine of EUR 122,000 on the company. The company was also issued a reprimand. In addition, the Finnish SA ordered the company to rectify its practices for requesting consent.

For further information:

The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.