Tietosuojavaltuutetun toimisto (Finland) - TSV/5175/2025
Finnish DPA fines plastic surgery clinic €20,200 for failing to provide patient records.
Finland's Data Protection Ombudsman has fined Plastic Surgery Center Helsinki Oy €20,200 for failing to comply with an order to provide a data subject access to their patient records. The clinic repeatedly ignored requests for information between 2016 and 2025, and even after a DPA order in June 2026, the provided data was insufficient and did not include all required details.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Plastic Surgery Center Helsinki Oy?
Get an email when a new story names Plastic Surgery Center Helsinki Oy, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonPlastic Surgery Center Helsinki repeatedly failed to honour a patient's legal right to access their own medical records, spanning from 2016 to 2025 — and even after a formal DPA enforcement order, the clinic's response was incomplete. This case illustrates that GDPR compliance is not just about preventing breaches; it equally requires organisations to actively fulfil data subject rights in a timely and complete manner. Ignoring or inadequately responding to subject access requests (SARs) exposes organisations to regulatory fines and reputational damage. Healthcare providers, who handle highly sensitive personal data, bear a heightened duty of care under data protection law.