Apoteket and Apohem Fined for GDPR Violations

The Swedish Authority for Privacy Protection (IMY) has imposed administrative fines totaling SEK 45 million on Apoteket AB (SEK 37 million) and Apohem AB (SEK 8 million) for violations of the General Data Protection Regulation (GDPR). The fines stem from the companies' use of Meta Pixel on their websites, which resulted in the transfer of sensitive personal data, including information about purchases of over-the-counter medicines, to Meta. IMY found that both companies failed to implement necessary procedures and monitoring to detect and prevent these improper data transfers, which continued for an extended period.

These enforcement actions highlight the critical need for regulated entities to ensure robust data protection measures, particularly when utilizing third-party analytics tools that handle sensitive personal information. Companies must have systematic approaches to security, including ongoing monitoring of data processing activities, to comply with GDPR. Failure to do so can result in significant financial penalties. While the specific compliance deadline for rectifying the issues is not stated, the fines underscore the importance of immediate review and remediation of data transfer practices to avoid further sanctions.