Finnish court overturns €1.1 million fine against state pharmacy over data protection breaches

A Helsinki administrative court has overturned a €1.1 million fine imposed on Yliopiston Apteekki, Finland’s state-owned pharmacy chain, ruling that public institutions cannot face administrative penalties under EU data protection law.

The Finnish Data Protection Ombudsman had issued the fine last year, citing deficiencies in the pharmacy’s online tracking services between 2018 and 2022. Yliopiston Apteekki contested the decision at the time, arguing the grounds were unfounded.

While the court acknowledged the pharmacy had violated the General Data Protection Regulation (GDPR), it annulled the penalty. Under Finnish law, independent public institutions—including university-affiliated entities like Yliopiston Apteekki—are exempt from GDPR administrative fines.