Plastic Surgery Center faces possible multimillion-euro fine over patient records

Plastic Surgery Center Helsinki could face a substantial fine for failing to provide patient records, Yle’s MOT reported. The Data Protection Ombudsman is considering an administrative penalty under the EU’s General Data Protection Regulation.

The case concerns a patient who underwent tattoo removal and has sought access to their records for up to 10 years. After the clinic failed to respond, the patient contacted the ombudsman, which ordered the company in June 2026 to provide the information. The clinic has not complied, according to the authority.

The ombudsman’s preliminary assessment is that a penalty should be imposed. Under the GDPR, the maximum is €20 million or 4 per cent of a company’s turnover in the previous financial year. Fines have so far generally been much lower. The ombudsman’s sanctions board is expected to decide whether to impose a fine in October or November. Any penalty would apply to Plastic Surgery Center Helsinki Ltd.

Documents seen by MOT indicate that the company initially told the ombudsman the patient had not been treated by Plastic Surgery Center Helsinki Ltd, suggesting they may have attended another clinic with a similar name. The ombudsman noted that the company had previously acknowledged treating the patient.

The treatment dispute was considered by Finland’s Consumer Disputes Board in 2023. The company said it had treated the patient appropriately and that the records were in order. The board recommended that it compensate the patient. The company also said its clinic did not perform laser tattoo removal, although the procedure was advertised on its website in October 2026.

MOT reported that authorities have encountered problems obtaining patient records from the company for at least seven years. In several cases, healthcare regulators said they could not assess whether care had been appropriate because records were incomplete or missing. The company’s chief executive, Karl Johan Svedjeholm, received a reprimand from the National Supervisory Authority for Welfare and Health in 2023, partly over this issue. A plastic surgeon who worked for the company received a reprimand from the Regional State Administrative Agency for Eastern Finland in 2025.

After social media influencer Olivia Oras died in August, the National Supervisory Authority for Welfare and Health also reported concerns about the clinic’s handling of patient records. Oras had been a client at the company’s Helsinki clinic. The authority said it had not received records relating to every complaint, and noted earlier complaints that records had been altered after the fact or stored in booking systems or email instead of a patient-record system. During an inspection, it found paper records in unlocked cabinets and drawers accessible to outsiders.

The Authority for Licensing and Supervision suspended the clinic on Aleksanterinkatu in September, citing risks to patient safety. It is not yet known whether Oras’s death was directly linked to the clinic’s actions. Police are investigating her death.