- Date of final decision: 27 December 2022
- Cross-border case, the decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS).
- LSA: Finland
- CSAs: Italy, Belgium, Czech Republic, France, Denmark,
- Greece, Germany, Hungary, the Netherlands, Norway, Slovakia, Slovenia, Sweden,
- Luxembourg, Spain and Poland
- Legal Reference: Processing of special categories of personal data (Article 9(2)), Conditions for consent (Article 7(2) and Article 7(4))
- Decision: Administrative fine, reprimand
- Key words: Health data, consent
Summary of the Decision
Origin of the case
The Finnish SA investigated the company's practices based on complaints made in 2018–2019. The investigations revealed that the company did not have the consent required by the GDPR for processing data on body mass indices and maximal oxygen uptake.
The company had asked for consent to the processing of health data in general but had not specified which data it was collecting and processing. The consent requested did not meet the requirements of the GDPR as it was not specific and informed.
The SA finds that the controller had informed the data subjects of the processing of their personal data but had nevertheless not provided sufficient information on the types of personal data being processed and the purposes of processing each type.
The SA especially pointed out that the extensive processing of health data is part of the company's core business.
The Finnish SA imposed an administrative fine of EUR 122,000 on the company. The company was also issued a reprimand. In addition, the Finnish SA ordered the company to rectify its practices for requesting consent.
For further information:
- National decision (FI)
- Press release on the Finnish SA’s website: Administrative fine imposed on company for processing health information without the appropriate consent (11 January 2023)
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.