The Finnish data protection authority sanctioned a healthcare service provider for transmitting health data to technology giants via tracking tools on its online appointment booking service, without adequate assessment or protective measures.

Facts and context

The Finnish data protection authority (Data Protection Ombudsman) issued a sanction decision against Mindemo Oy, including a fine of €33,000, for breaches related to the use of cookies and tracking tools on its online therapy appointment booking service.

The case follows an investigation by the authority concerning the company's, formerly known as Heltti Oy, use of cookies and other tracking tools on its online booking service.

Grounds for the decision

The authority found the following breach:

• Obligation to ensure the security of processing (Article 32 of the GDPR): The authority found that the company transmitted health data to Google, Meta, and Microsoft through tracking tools integrated into its appointment booking service. These data, which included information on the start and confirmation of the appointment, the type of therapy, and the chosen therapist, were neither anonymized nor pseudonymized in a way that prevented user identification, notably via their IP address and other technical data. The authority considered that implementing these tools without prior assessment or sufficient protective measures constituted a breach of the obligation to ensure the security of personal data, especially concerning such sensitive data, and this for at least one year.

Authority's decision

Consequently, the authority imposed a fine of €33,000 on Mindemo Oy.

Furthermore, the authority issued a reprimand against the company for its breaches of the security of personal data processing. However, the authority positively noted that during the investigation, the company had removed the tracking services and requested the relevant providers to delete the collected data.

Lessons learned

This decision reminds that:

• The integration of analytics and tracking tools on services processing special categories of data, such as health data, requires particularly rigorous planning and risk assessment before implementation.
• The transmission of sensitive data to third parties, even accompanied by technical identifiers like an IP address, cannot be considered secure if this information allows re-identification of the data subject.
• The swift implementation of corrective measures after discovering non-compliance, such as removing tracking tools and requesting data deletion, is an important factor considered by the authority to mitigate consequences for data subjects.