Enforcement · Deputy Data Protection Ombudsman EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Company: Insufficient legal basis for data processing

The Finnish DPA has imposed a fine of EUR 122,000 on a company with products that process health data, such as heart rate, etc.

€122,000 Fine
Company
FINLAND
Art. 9 GDPR
Healthcare Consent Types of Special Categories of Personal Data Personal Data Processing
Dec 27, 2022 Source tietosuoja.fi

Full text

The Finnish DPA has imposed a fine of EUR 122,000 on a company with products that process health data, such as heart rate, etc. The DPA had received several complaints regarding the processing of health data from data subjects. During its investigation, the DPA found that the company did not have a sufficient legal basis to process various types of health data. While the company had informed users of the products about the processing of personal health data in general, it had failed to provide information for each of the different types of health data (e.g., body mass index or oxygen capacity), such as the purpose of the processing. Accordingly, the DPA found that the users' consent could not be valid since it was not given on an individual basis and with full knowledge of the facts.

Industry: Industry and Commerce

How it connects

References

Related across sources

C-667/21 ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts The CJEU (Third Chamber) ruled on a preliminary reference from the Bundesarbeitsgericht in a case where ZQ sought compensation from his employer, Medizinischer Dienst der… CJEU ·Third Chamber Dec 21, 2023 Health Data Healthcare Integrity and Confidentiality Principle
C-21/23 ND v DR In Case C-21/23, the Court of Justice of the European Union (Grand Chamber) ruled on a preliminary reference from the German Bundesgerichtshof in proceedings between two competing… CJEU ·Grand Chamber Oct 4, 2024 Healthcare Health Data Types of Special Categories of Personal Data
C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Automated Decision-Making Marketing
C-205/21 Criminal proceedings against V.S In Case C-205/21, the Court of Justice of the European Union (Fifth Chamber) issued a preliminary ruling responding to a request from the Spetsializiran nakazatelen sad… CJEU ·Fifth Chamber Jan 26, 2023 Types of Special Categories of Personal Data Personal Data Retention Period
C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… CJEU ·Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision
Guidelines 05/2020 consent under Regulation 2016/679 Guidelines on consent Guidelines ·EDPB May 4, 2020 Consent Data Portability Personal Data
Related documents