In February 2026, prosecutors brought data protection charges against over 50 healthcare professionals, among them around 20 doctors, at Oulu University Hospital. They are alleged to have unlawfully accessed the medical records of a fellow employee who was a patient at the hospital. The case is a classic example of an increasingly common situation in which an employee accesses another person’s or company’s data without authorisation, usually out of curiosity. The same series of incidents prompted the Finnish Deputy Data Protection Ombudsman to issue a separate regulatory decision on 12 February 2026, finding that the controller, the Wellbeing Services County of North Ostrobothnia, had itself breached the GDPR by failing to implement adequate safeguards.
