Owner Finds Sensitive Patient Files at Abandoned Ylöjärvi Rehab Centre

Yle reports that Suvi Rajala found patient records at the long-abandoned Ylisen rehabilitation centre in Ylöjärvi last year.

Rajala, who now owns the roughly 18-hectare site, uncovered documents showing names, personal identity numbers and patient notes in several buildings. She destroyed the material and notified the Pirkanmaa welfare region.

The centre had already yielded confidential files in 2021. That lapse qualified as a data protection breach, and the region said the remaining papers were destroyed and an inspection was carried out.

Minna Kuusela, Pirkanmaa’s social services director, said she only learned about the recent finds when she was contacted and suspects an internal information gap. She called the situation regrettable and said the welfare region will investigate.

Assistant Data Protection Commissioner Annina Hautala reminded organisations that data controllers must notify the Data Protection Ombudsman whenever personal data reaches outside parties, even without malicious intent. Kuusela and Hautala urged clearer procedures so identifiable items are removed during property transfers.

Similar incidents have occurred recently. Earlier this year, pupil psychological assessments were found exposed in a former Ruovesi restaurant in which sensitive school records were left accessible, and Pirkanmaa previously dismissed a specialist after a separate patient privacy breach over leaked oncology documents.