The Helsinki Administrative Court has overturned a 1.1-million-euro penalty imposed on pharmacy chain Yliopiston Apteekki by the Office of the Data Protection Ombudsman.
The ombudsman's office imposed the penalty last year, after finding data protection shortfalls due to its customer tracking during 2018-2022.
The ombudsman's investigation found that the pharmacy firm, owned by the University of Helsinki, had used cookies and other tracking tech in its online store. According to the data protection body, the chain said it discontinued the use of Google's and Meta's tracking technologies in September 2022.
When the fine was imposed, Yliopiston Apteekki said it disagreed with the ombudsman's findings.
The Administrative Court found that Yliopiston Apteekki had acted contrary to the General Data Protection Regulation (GDPR), an EU rule aimed at safeguarding personal data.
However, the court overturned the fine, noting that administrative penalties under the data protection regulation cannot be imposed on independent public law institutions.
According to the preparatory works of the Data Protection Act, independent public law institutions also include universities.
