Finland

The Ombudsman fined Mehiläinen for inadequate governance over processor access to patient systems and insufficient audit logging under GDPR Articles 28 and 32.

The authority found deficiencies in customer authentication and disclosure controls that risked unauthorized access to subscriber data under GDPR Articles 25 and 32.

The Ombudsman sanctioned Finland's social insurance institution over insufficient access restrictions to sensitive benefits data, citing GDPR Articles 5, 24 and 32.

The authority examined Wolt's customer and courier data processing, highlighting transparency and lawful-basis issues around profiling and service analytics under GDPR Articles 6, 13 and 22.

The Ombudsman criticized Espoo for excessive retention of student welfare records and incomplete information notices, implicating GDPR Articles 5 and 13.

The authority reviewed cookie and advertising consent flows and found insufficient granularity and transparency under GDPR Articles 5, 6, 7 and ePrivacy-related requirements.

The Ombudsman sanctioned HUS over unauthorized internal access to patient records and insufficient monitoring of user activity, engaging GDPR Articles 5, 24 and 32.

The authority found Telia's direct-marketing consent and objection handling insufficient, citing GDPR Articles 6, 7, 12 and 21.

The Ombudsman fined a pharmacy operator for inadequate access controls and retention practices affecting prescription and customer data under GDPR Articles 5 and 32.

Finland's Data Protection Ombudsman sanctioned Posti for excessive employee location and work-performance monitoring without adequate lawful basis or transparency, implicating GDPR Articles 5, 6 and 13.