Plastic Surgery Center Helsinki fined for not complying with an order of the Office of the Data Protection Ombudsman

Plastic Surgery Center Helsinki fined for not complying with an order of the Office of the Data Protection Ombudsman

The Sanctions Board of the Office of the Data Protection Ombudsman has imposed an administrative fine of EUR 20,200 to Plastic Surgery Center Helsinki Oy because the company did not give a customer their medical records regardless of an order from the Office of the Data Protection Ombudsman to do so. The customer had requested access to their data from the clinic in order to submit a complaint for deficiencies in the care provided to the customer.

The Office of the Data Protection Ombudsman investigated the company based on a complaint. The customer stated that they had requested the clinic to provide access to their data several times between 2016 and 2025 so that the customer could file a complaint about the care they received and seek damages.

In June 2026, the Office of the Office of the Data Protection Ombudsman ordered the clinic to provide access to the data within two months. After the deadline, the customer reported that they were still not given access to their data.

"Individuals' right to access their medical data is extremely important for their protection under law. If access is not provided, customers cannot assess the actions of healthcare professionals and the appropriateness of the care provided to them, for example", says Deputy Data Protection Ombudsman Heljä-Tuulia Pihamaa.

The Sanctions Board deemed that the company had intentionally not complied with the order. The company also did not request review of the order.

"As a rule, not complying with the orders of authorities results in the issuance of an administrative fine", says Pihamaa.

The administrative fine was imposed because the case involved a data subject's vital right to access data concerning their health. The company also did not take any actions to mitigate or remedy the harm caused to the customer. The decision is not final and can be appealed to the Administrative Court.

More information:

Decision TSV/5175/2025 of the Deputy Data Protection Ombudsman and the Sanctions Board in Finnish in the Finlex service

Deputy Data Protection Ombudsman Heljä-Tuulia Pihamaa, helja-tuulia.pihamaa(at)om.fi, tel. +358 29 566 6787