Deputy Data Protection Ombudsman · 4 September 2023
Company
Insufficient fulfilment of data subjects rights
- Regulator
- Deputy Data Protection Ombudsman
- Decided
- 4 September 2023
- Country
- Finland
- Sector
- Health Care
- Regulator’s reference
- Not recorded
- Fino case number
- 2023/FI/001
What happened
The Finnish DPA fined a psychotherapist €1,600 for not complying with a data subject's access request regarding treatment history and notes made during the sessions, within the Article 12(3) GDPR time limit. Moreover, the DPA declared that the therapist had breached Article 12(4) GDPR, as they did not inform the data subject of the reasons for non-compliance.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subject12(3)Read →
- Art. 15Right of access by the data subjectRead →
- Data subject rights
- Transparency
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2023/FI/001.