Finnish SA: Administrative fine imposed on psychotherapy provider for shortcomings in fulfilling the client's right of access to data

4 September 2023

Background information

  • Date of decision: 4 September 2023
  • Cross-border case or national case: National case
  • Legal references: Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject)
  • Decision: Administrative fine, Reprimand
  • Key words: Health data

 

Summary of the Decision

 

Origin of the case

A client of a psychotherapy provider had requested access to their data on several occasions in 2017–2019. The client never received any justification for why the data could not be delivered.

In its report to the Finnish SA, the controller admitted that it had not fulfilled the client's right of access to data as required by the GDPR. In the decision, particular attention was paid to the fact that the Finnish SA had given the controller guidance for replying to the client's request already in 2020. The company delivered the information to the client in April 2021.

 

Key Findings

The company had not provided its client with a reason for why it could not deliver the patient records for psychotherapy sessions or replied to the data subject without delay. The Finnish SA notes that the duty of care and responsibility for fulfilling the data protection rights of the data subject are emphasised in psychotherapy services. Psychotherapy clients may be in a vulnerable position and are not necessarily able to monitor the fulfilment of their data protection rights.

 

Decision

An administrative fine of EUR 1,600 was imposed on the psychotherapy provider. In addition to the administrative fine, the Finnish SA reprimanded the controller for the shortcomings in fulfilling the right of access. The imposition of an administrative fine was supported by the intentionality of the company's actions and the damage caused to the client.

 

For further information:

The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.