Finland Data Protection & Privacy Regulation

Controller/Processor Duties

Finland's Sanctions Board, the body within the Office of the Data Protection Ombudsman holding sole competence under section 24 of the Data Protection Act to impose GDPR Article 83 administrative fines, imposed a EUR33,000 administrative fine and reprimand on Mindemo Oy on 8 October 2026. Mindemo, a health-adjacent booking service formerly operating under the name Heltti Oy, was found to have serious deficiencies in the secure processing of appointment-related data. The data at issue included appointment start and confirmation details and the name of the selected therapist, which were transmitted to Google, Meta and Microsoft through tracking tools over a period running from April 2024 to May 2025.

The decision frames the failure as a security-of-processing issue: the deficiency lies not in the existence of a lawful basis for the underlying appointment-booking activity but in the absence of adequate technical and organisational safeguards preventing sensitive, health-adjacent scheduling data from flowing to third-party advertising and analytics platforms through embedded tracking tools. The fact that the data concerned therapist selection and appointment confirmation for a health-adjacent service elevates the sensitivity of the processing failure beyond a routine cookie-consent question, even though the decision is also separately relevant to adtech-specific scrutiny of the tracking mechanism itself.

Mindemo has stated that it has since removed the tracking tools responsible for the transmission and has requested deletion of the data already transmitted to Google, Meta and Microsoft from those platforms. This remediation step was noted but did not prevent the Sanctions Board from proceeding to a fine and reprimand, indicating that post-hoc remediation does not retroactively cure a security-of-processing failure that persisted for over a year.

The structural architecture underlying this decision is the standing Sanctions Board competence confirmed via Finland's primary rules of procedure: the Ombudsman and Deputy Ombudsmen together constitute the Sanctions Board for Article 83 fines and for Article 58(2)(f) and (j) restriction, processing-ban and transfer-suspension measures, while the Ombudsman alone retains other corrective powers. This decision was therefore issued through the Sanctions Board's dedicated fining competence rather than through the Ombudsman's general supervisory powers.

Outlook

The Mindemo decision, falling within the current recency window, signals that security-of-processing obligations connected to third-party tracking integrations remain a live area of Sanctions Board scrutiny, particularly where the underlying data concerns health-adjacent services. Whether further controller/processor duty decisions follow against comparable health-adjacent or booking-platform operators in Finland is not yet established from this cycle's material, and the remediation steps taken by Mindemo, including tool removal and deletion requests to recipient platforms, have not been reported to have altered the fine outcome.

Controller/Processor Duties

The Supreme Administrative Court's June 2026 confirmation of the roughly EUR 795,000 fine against retailer Verkkokauppa.com closes the appeal cycle on one of Finland's most significant controller-accountability enforcement actions. The fine was upheld against both the Administrative Court's and the Sanctions Board's original decisions, for the retailer's failure to define a data-retention period for online-purchase data — a straightforward accountability and storage-limitation finding that the courts have now fully endorsed on appeal.

Separately, following the KHO:2023:82 ruling, a more restrictive development is understood to be developing in how controllers respond to Ombudsman information requests, given a tension identified between accountability obligations and the privilege against self-incrimination. This is not yet a settled doctrine but a case-law-driven pressure point that controllers facing Ombudsman inquiries should watch, since it may reshape the practical scope of cooperation duties during investigations. The number of cases initiated annually at the Office of the Data Protection Ombudsman is understood to have grown to exceed 13,000, including a rising volume of breach notifications, which points to an increasingly active supervisory caseload against which controller-processor compliance will be tested.

Outlook

The Verkkokauppa.com precedent is likely to sharpen retention-period practices across Finnish e-commerce controllers going forward. The KHO:2023:82 tension over information-request compliance remains to be resolved in practice, and how the Ombudsman calibrates its investigative approach in light of it is a matter to watch closely.

AdTech & Commercial Privacy

The Sanctions Board of the Office of the Data Protection Ombudsman imposed a EUR 33,000 administrative fine on Mindemo Oy, published 8 October 2026, for introducing cookies and tracking tools into its online health-appointment booking service without sufficient risk assessment or protective measures. The decision found that health-related data was transmitted to tracking-service providers for at least a year as a result. Mindemo Oy was formerly known as Heltti Oy. This is a cookies-and-trackers finding concerning a service handling special-category health data, which heightens the significance of the risk-assessment failure identified.

The decision reflects the Sanctions Board's willingness to impose administrative fines where a controller introduces third-party tracking technology into a service touching health data without conducting an adequate risk assessment of that integration beforehand, and without implementing protective measures proportionate to the sensitivity of the data being transmitted as a result.

Outlook

The Mindemo Oy decision sets a reference point for how the Sanctions Board assesses cookie and tracker deployments in services touching special-category data. Whether further AdTech-sector decisions follow in the near term, and whether the Board's approach extends to services outside the health sector, remains to be observed.

AdTech & Commercial Privacy

Finland's Sanctions Board fined Mindemo Oy EUR33,000 on 8 October 2026 for transmitting appointment-related data, including appointment start and confirmation details and the selected therapist's name, to Google, Meta and Microsoft via cookies and tracking tools embedded in its health-adjacent booking service. The transmission occurred over a period of at least a year, between April 2024 and May 2025, meaning the tracking integration operated continuously across multiple booking cycles before the deficiency was addressed.

The adtech dimension of this decision concerns the mechanism of data transmission rather than the underlying data-processing purpose: cookies and tracking tools integrated into the booking flow sent appointment and therapist-selection data to three major advertising and analytics platforms as a byproduct of standard web-tracking configurations, rather than through any deliberate direct-marketing use of the data by Mindemo itself. This is a now-familiar typology in Finnish enforcement practice, where health-adjacent or otherwise sensitive booking and scheduling services deploy third-party tracking tools without adequately isolating sensitive categories of data from advertising-platform pixels and scripts.

Mindemo has stated it has since removed the tracking tools responsible for the transmission and has requested that Google, Meta and Microsoft delete the data already received. The Sanctions Board proceeded to a fine and reprimand notwithstanding this remediation, indicating that the adtech-and-commercial-privacy failure, once it had occurred and persisted for the duration described, was treated as a completed infringement rather than one cured by subsequent tool removal.

The fine amount, EUR33,000, is moderate in scale relative to some other enforcement actions reported this cycle, but the Sanctions Board's choice to combine a monetary fine with a formal reprimand indicates the Board treated the duration and sensitivity of the data at issue, appointment and therapist-selection information tied to a health-adjacent service, as aggravating factors within the adtech-and-commercial-privacy assessment.

Outlook

The Mindemo decision reinforces a continuing Sanctions Board focus on cookie and tracking-tool configurations in sectors handling health-adjacent or otherwise sensitive booking data, an area where commercial tracking infrastructure and sensitive personal data intersect without always being separately risk-assessed by controllers. Future adtech-and-commercial-privacy enforcement in Finland may continue to target this intersection, particularly where tracking tools are deployed by default across booking platforms without sector-specific data-sensitivity review, though no further dated action in this specific area has surfaced this cycle beyond the Mindemo decision itself.

AdTech & Commercial Privacy

The Office of the Data Protection Ombudsman is understood to have updated its FAQs on direct marketing, emphasising information-disclosure duties toward data subjects and the obligation to honour opt-out requests. This is non-binding guidance rather than a change in binding legal obligation, but it signals where the Ombudsman's current supervisory attention within commercial-privacy practice is directed.

Outlook

As non-binding guidance, this FAQ update does not itself create new enforcement exposure, but organisations engaged in direct marketing to Finnish data subjects should note the Ombudsman's emphasis on disclosure and opt-out handling as an indicator of likely supervisory focus areas going forward.

Algorithmic, Biometric & Surveillance Governance

Finland's algorithmic-governance landscape now operates across two layers: the longstanding data protection framework applied by the Office of the Data Protection Ombudsman, and a dedicated national AI Act enforcement layer that came into force at the start of this year. The Act on the Supervision of Certain Artificial Intelligence Systems, approved by the President on 22 December 2025, took effect on 1 January 2026, granting Traficom and relevant sectoral authorities investigatory and sanctioning powers in connection with the EU AI Act. This gives Finland a designated domestic enforcement structure for AI Act obligations, running alongside the EU regulation's own compliance timeline.

Within the data protection framework proper, the Deputy Data Protection Ombudsman has ordered a company operating a customer loyalty scheme to change its customer-information policies after finding that the policy did not disclose the automated decision-making and profiling the scheme actually performed. This is a profiling-transparency enforcement action under the existing GDPR framework rather than an AI Act matter, but it illustrates the kind of algorithmic-governance question Finnish authorities are actively willing to intervene on: not the underlying use of automated decision-making itself, but the adequacy of disclosure to the individuals affected by it.

Together, these two threads, the new AI Act enforcement layer at Traficom and continuing profiling-disclosure enforcement at the Ombudsman, indicate that algorithmic governance in Finland is becoming a genuinely dual-track oversight area, with sectoral and data protection authorities each exercising powers relevant to automated systems.

Outlook

How Traficom's new investigatory and sanctioning powers under the national AI Act enforcement layer interact in practice with the Ombudsman's existing profiling-transparency enforcement is the area to watch, particularly as more AI Act compliance deadlines are reached and as further Ombudsman decisions on automated decision-making and profiling emerge.

Enforcement & Redress

Finland's Sanctions Board continued active enforcement across sectors this period. On 13 October 2026, the Board fined Plastic Surgery Center Helsinki Oy 20,200 euros for failing to provide a customer's medical records despite an existing Ombudsman order requiring it to do so, illustrating that enforcement reaches both large commercial controllers and smaller specialist healthcare-adjacent providers. This sits alongside the Supreme Administrative Court's June 2026 decision upholding an administrative fine of approximately 795,000 euros against Verkkokauppa.com for failing to specify storage periods for customer account data, a decision that confirms judicial backing for the Sanctions Board's reasoning on data-retention transparency even when a fined company seeks court review.

Taken together with the leading breach-notification precedent against Aktia Bank Plc, fined approximately 865,000 euros for a security flaw under GDPR Article 32 that exposed other customers' health and financial data to around 350 people, the current enforcement record spans retention practices, security obligations, and data-subject access failures, indicating a broad and active enforcement posture rather than concentration on any single type of infringement.

This enforcement intensity is set against the backdrop of the pending HE 46/2026 vp reform, which would for the first time extend the Sanctions Board's fining power to public-sector controllers and processors, with statutory maxima of 500,000 or 1,000,000 euros. Enforcement and redress against public authorities currently remains limited to non-monetary remedies, since administrative fines are not yet available against that sector.

Outlook

Continued enforcement activity against both large commercial controllers and smaller specialist providers suggests the Sanctions Board's enforcement intensity is unlikely to ease in the near term. The passage of HE 46/2026 vp, whenever it occurs, would be the next structural shift to watch, since it would extend fining power to the public sector for the first time and materially broaden the population of entities exposed to administrative sanction under the Finnish GDPR regime.

Enforcement & Redress

The Sanctions Board of the Office of the Data Protection Ombudsman imposed a EUR 20,200 administrative fine on Plastic Surgery Center Helsinki Oy, published 13 October 2026, for knowingly failing to comply with an earlier order from the Ombudsman's office, issued in June 2026, which had required the company to provide a client access to their patient data within two months. The company did not appeal the underlying access order. The fine was therefore imposed not for the original access-rights failure itself but for the company's knowing non-compliance with the Ombudsman's subsequent corrective order.

This sequencing, an unappealed investigatory order followed by a separate Sanctions Board fine for non-compliance with that order, illustrates the institutional division in Finland's enforcement architecture: administrative fines under GDPR Article 83 are decided by the Sanctions Board, composed of the Data Protection Ombudsman and two deputy ombudsmen, distinct from the Ombudsman's own investigatory and corrective-order function.

Outlook

The Plastic Surgery Center Helsinki Oy decision illustrates the consequence of non-compliance with an Ombudsman order once it has become final and unappealed. Whether further enforcement follows against the same controller, or whether this fine resolves the matter, is not established on the current record.

Enforcement & Redress

Finland's Sanctions Board has maintained an active enforcement tempo across several dated actions surfacing this cycle, spanning adtech-adjacent security failures, access-right non-compliance, and a large cross-border cooperation-procedure fine, alongside a live appeal before the Supreme Administrative Court.

On 8 October 2026, the Sanctions Board imposed a EUR33,000 fine and reprimand on Mindemo Oy, a health-adjacent booking service formerly known as Heltti Oy, for serious deficiencies in the secure processing of appointment-related data transmitted to Google, Meta and Microsoft via tracking tools between April 2024 and May 2025. This decision falls within the strict recency window for the current cycle and signals continued scrutiny of health-adjacent service providers' use of third-party tracking integrations.

Earlier in the year, on 25 March 2026, the Sanctions Board imposed a EUR5,000 fine on Suomen Numerokeskus Oy for systematically failing to honour customers' right of access to their own recorded customer-service calls. The company had deleted call recordings despite pending access requests from customers, a straightforward access-right enforcement action illustrating continued Board attention to Article 15 compliance in sectors handling recorded customer interactions.

On 8 May 2026, a substantially larger fine, EUR100 million, was reportedly issued against MLU B.V., operating as Yango, for unlawful transfer of Finnish and other users' personal data to Russia. This fine was issued through the EU data protection authorities' cooperation procedure under GDPR Articles 60 to 66, reflecting cross-border coordination among EU supervisory authorities rather than a purely domestic Finnish enforcement action. The lead authority for this decision, and the extent of the Finnish Ombudsman's role as lead or concerned authority, has not been confirmed this cycle, leaving open the question of how directly this result should be attributed to Finnish enforcement activity as opposed to the broader EU cooperation mechanism.

Separately, the redress side of Finland's enforcement architecture saw a significant procedural development on 12 June 2026, when the Supreme Administrative Court granted Verkkokauppa.com Oyj leave to appeal against a 6 March 2024 Sanctions Board decision. That underlying decision had imposed a fine, reported elsewhere as EUR856,000, under GDPR Articles 58(2)(i) and 83 over undefined personal-data retention periods for online-store customer accounts. The Court declined the Ombudsman's request to refer the matter to the Court of Justice of the European Union for a preliminary ruling, meaning the appeal will proceed on national law grounds. The underlying fine remains unresolved while the appeal is live.

Outlook

The Verkkokauppa.com Oyj appeal is the most consequential open item in Finland's enforcement and redress landscape: its outcome will determine whether a multi-hundred-thousand-euro fine over data-retention-period practices for online-store customer accounts is upheld, reduced or overturned, and the Court's decision not to seek a CJEU preliminary ruling means the result will turn on the Supreme Administrative Court's own interpretation of national and EU retention-period requirements. Confirmation of the lead-authority question for the MLU B.V. (Yango) fine would clarify how much of that EUR100 million action should be read as a Finnish enforcement outcome as opposed to a cooperation-procedure result led by another EU authority. Taken together, the dated actions this cycle indicate the Sanctions Board is sustaining enforcement activity across multiple sectors and failure types simultaneously, from adtech-adjacent security lapses to access-right non-compliance to large-scale cross-border transfer violations.

Enforcement & Redress

Finland's enforcement posture escalated materially this cycle on multiple fronts. The Supreme Administrative Court upheld the approximately EUR 795,000 fine against retailer Verkkokauppa.com in June 2026, confirming the Sanctions Board's and Administrative Court's original decisions for the retailer's failure to define a data-retention period. This is the clearest and most significant confirmed enforcement outcome of the cycle. The Sanctions Board, composed of the Data Protection Ombudsman and deputy ombudsmen, retains the power to impose fines of up to EUR 10 million or 2 percent of worldwide annual turnover for certain violations, and up to EUR 20 million or 4 percent for more serious infringements, the standard GDPR fining tiers as applied in Finland.

2024 fines from the Office of the Data Protection Ombudsman reached a new annual high of EUR 2.4 million, the largest total to date in Finland, and the Ombudsman is expected to participate in the 2026 EDPB Coordinated Enforcement Framework. Most significantly for the forward enforcement landscape, the Government submitted proposal HE 46/2026 vp to Parliament in April 2026 to amend the Data Protection Act so that administrative fines may, for the first time, be imposed on public-sector controllers and processors, a category of entity previously immune from monetary GDPR penalties in Finland.

Outlook

Whether HE 46/2026 vp is enacted remains the single most consequential open question for Finland's enforcement architecture; its passage would close a longstanding public-sector accountability gap. Combined with the record 2024 fine total and the confirmed Verkkokauppa.com appellate outcome, the trajectory points toward an increasingly assertive Sanctions Board and Ombudsman over the coming enforcement cycles.