Finnish SA: Administrative Fine on the Company for Processing Health Information without an Appropriate Consent

On January 27, 2023, the European Data Protection Board ("EDPB") published on its official website the news that Finnish Supervisory Authority ("SA") administrative fine on the company for processing health information without appropriate consent.

The Finnish SA investigated the company's practices based on complaints made in 2018–2019. The investigations revealed that the company did not have the consent required by the GDPR for processing data on body mass indices and maximal oxygen uptake.

The company had asked for consent to the processing of health data in general but had not specified which data it was collecting and processing. The consent requested did not meet the requirements of the GDPR as it was not specific and informed.

The Finnish SA imposed an administrative fine of EUR 122,000 on the company. The company was also issued a reprimand. In addition, the Finnish SA ordered the company to rectify its practices for requesting consent.

You can reach further information here.

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr