Finland

Plastic Surgery Center Helsinki Oy

20,200 €

GDPR enforcement action by Deputy Data Protection Ombudsman on 2026-10-12.

Rank · Sector

#105

of 290 in Health Care

Rank · Finland

#20

of 29

Rank · All fines

#1,079

of 3,223

Case details

Authority: Deputy Data Protection Ombudsman
Date: 2026-10-12
Controller / Processor: Plastic Surgery Center Helsinki Oy
Sector: Health Care
Quoted Articles: Art. 58 (2) c) GDPR, Art. 83 (6) GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The Finnish DPA has imposed a fine of EUR 20,200 on Plastic Surgery Center Helsinki Oy. A former patient of the clinic had requested access to their records multiple times between 2016 and 2025. The authority then ordered the controller to comply with the access request by 29 August 2026. However, the data subject complained on 30 August 2026 that they still had not received the relevant records. During the investigation, the controller stated that they did not offer the procedure that the data subject claimed to have undergone. However, this was found to be untrue, as the hospital had advertised the procedure on its website.

Open original source Links to the regulator's original publication or another source.