Helsinki clinic fined EUR 20,200 for ignoring patient-data order

A Helsinki private clinic that ignored a binding order to hand over a patient's recordsFinlex must now pay the state an administrative fine of EUR 20,200Finlex. The sanctions board of the data protection authority imposed the fineFinlex on Plastic Surgery Center Helsinki OyFinlexFinlex for defying an order to satisfy a data subject's access request under Article 15(1) and (3) of the General Data Protection RegulationFinlex.

The order came first. On 29 June 2026 the data protection authority directed the clinic to give the data subject the Article 15(1) and (3) informationFinlex no later than 29 August 2026Finlex. The background was a request history stretching from 2016 to 2025: the individual had repeatedly asked to see their own records, and the clinic had answered that the person had never been its patient and that no data could be found in the patient information system. The authority did not accept that account. It pointed to a Consumer Disputes Board decision of 11 August 2023 concerning treatment the same person received at the clinic, in which the clinic's own reply to the board acknowledged the treatment and stated that the patient's records had not been deleted. On that basis the authority treated it as established that the clinic processes the individual's personal data and ordered it to honour the access request.

The day after the deadline, on 30 August 2026, the data subject told the authority that nothing had arrivedFinlex. The clinic's response to the hearing request was to repeat that it has never offered tattoo-removal services and that the requester was never its patient, without addressing the substance further. It also failed to supply the requested figure for its 2025 total turnover. Only on 4 October 2026 did the clinic forward some data concerning the requester to the authority, which passed it on — but the material amounted, in the data subject's account, to the clinic's own notes showing no more than an appointment date and a price, not official patient records, and the late delivery could not cure the missed 29 August deadlineFinlex in any event.

The 'wrong company' defence failed on finality. The Helsinki Administrative Court confirmed on 3 September 2026 that the clinic had not appealed the June decisionFinlex, so the order stands with legal force. A controller that considers an order misaddressed or otherwise wrong must appeal it or seek correction under section 50 of the Administrative Procedure Act; having done neitherFinlex, the clinic is taken to have accepted the decision, and the order remains in force and must still be obeyed.

In setting the fine, the sanctions board weighed the Article 83(2) factors. The data are health data falling within the special categories of Article 9, and access matters acutely here because the individual needs the records to complain about the treatment received and claim compensation — a point the board counted in favour of a fine. The breach was deliberate rather than a human errorFinlex: the clinic knowingly left a served order unimplementedFinlex. It took no steps to mitigate the harm, and its non-cooperation, including withholding the turnover figure, counted as aggravating. With 2024 turnover of EUR 2,019,987.30 the maximum stood at EUR 20 million; the board fixed EUR 20,200 as effective and proportionateFinlex for a breach lasting just under two months. The order can be appealed to the Helsinki Administrative Court under section 25 of the Data Protection Act (1050/2018).

Legal basis: Regulation (EU) 2016/679, Articles 15, 58(2)(d) and (i) and 83(6); Data Protection Act (1050/2018), section 24.