Finnish Clinic Fined €20,200 for Ignoring Patient Data Access Rights Over Nine Years
Written by AI from the linked story. Not reviewed by an editor. How this works
Plastic Surgery Center Helsinki repeatedly failed to honour a patient's legal right to access their own medical records, spanning from 2016 to 2025 — and even after a formal DPA enforcement order, the clinic's response was incomplete. This case illustrates that GDPR compliance is not just about preventing breaches; it equally requires organisations to actively fulfil data subject rights in a timely and complete manner. Ignoring or inadequately responding to subject access requests (SARs) exposes organisations to regulatory fines and reputational damage. Healthcare providers, who handle highly sensitive personal data, bear a heightened duty of care under data protection law.
Tactical Insight
Immediate actions
- Establish a formal, documented Subject Access Request (SAR) process with assigned ownership and a tracked response deadline of 30 days.
- Audit all outstanding or historical data subject requests to identify and remediate any unresolved or incomplete responses.
Long-term improvements
- Implement a case management system to log, track, and escalate all data subject rights requests automatically.
- Train all staff — including clinical and administrative personnel — on GDPR data subject rights obligations and internal escalation procedures.
- Designate a Data Protection Officer (DPO) or equivalent role with authority to enforce compliance with regulatory orders.
Detection & oversight measures
- Conduct periodic internal audits of SAR handling to verify completeness, timeliness, and accuracy of information provided.
- Establish a direct escalation pathway so that DPA enforcement orders trigger immediate senior-level review and a structured remediation plan.