Finland's Office of the Data Protection Ombudsman's sanctions board has imposed a 1.1 million euro penalty on pharmacy chain Yliopiston Apteekki for data protection failures.
The Ombudsman's investigation found that the pharmacy firm, owned by the University of Helsinki, had used cookies and other tracking tech in its online store.
As a result, transaction data related to both prescription and over-the-counter medicines was transmitted to companies such as Google and Meta. This included information such as when customers added medications to their virtual shopping cart or clicked the purchase button.
Users' IP addresses and other identifying information were also shared. If a customer was logged into Google or Facebook while browsing, they could have been identifiable to Google or Meta (Facebook's parent company).
The Ombudsman's office began investigating the practices of Yliopiston Apteekki after being contacted by a doctoral researcher from the University of Turku.
The investigation examined the period from May 2018 to September 2022. According to the data protection body, the pharmacy chain said it discontinued the use of Google's and Meta's tracking technologies in September 2022.
The decision is not yet final. Yliopiston Apteekki intends to appeal to the administrative court as it disagrees with the ruling.