Finnish Data Protection Authority Imposes €1.1 Million Administrative Fine on Pharmacy Company

Following an investigation conducted by the Finnish Data Protection Authority, an administrative fine has been imposed on the pharmacy company Yliopiston Apteekki (“the Company”) due to data protection deficiencies identified in its online pharmacy service.

• The investigation was initiated after a doctoral researcher, as part of a study focusing on the functioning of health-related online services, detected data protection vulnerabilities in online pharmacies in Finland and reported them to the Finnish Data Protection Authority.
• It was established that through the use of cookies and other tracking technologies in the Company’s online service, data regarding user interactions with both prescription and over-the-counter medicines -such as adding items to the shopping cart or clicking the purchase button- were transmitted to third parties including Google and Meta.
• Among the data transmitted were IP addresses and other information that could potentially enable the identification of individual users.
• In addition, it was assessed that if users were logged into their Google or Facebook accounts while using the online pharmacy service, these platforms were in a position to directly identify the users.
• In light of all these considerations, it was concluded that the Company had violated Articles 5(1)(f) and 32 of the GDPR, and an administrative fine of €1,100,000 was imposed.

You can access the full text of the Decision  here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.