Administrative Fine Imposed on Psychotherapy Centre Vastaamo for Data Protection Violations

The Finnish Data Protection Authority (“DPA”) has released its decison regarding the psychotherapy centre Vastaamo. The Finnish DPA has imposed an administrative financial sanction on the psychotherapy centre Vastaamo due to a violation of the provision of the GDPR. Vastaamo neglected its duties related to the safe processing of personal data as well as reporting a personal data breach. Deficiencies were also found in drawing up the documentation related to accountability.

The DPA issued Vastaamo a reprimand on violating the GDPR. The sanctions board of the DPA imposed an administrative financial sanction of EUR 608 000 on Vastaamo.

The sanctions board considers the acts of negligence extremely serious and Vastaamo’s actions in neglecting the duty to notify intentional. Furthermore, the violations were long-lasting.

Vastaamo was declared bankrupt in February 2021. An administrative fine is the lowest priority claim in a bankruptcy. Therefore, the financial sanction will not reduce the funds available for other claims in bankruptcy, such as potential compensation for damages.

You can find the full text here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr