Comment by jruohonen
19 hours ago
Indeed, the CEO was held criminally liable, but the charges were dropped in a higher court just recently. From the article:
"In April 2023, Tapio was found guilty of criminal negligence in his handling of patient data. His conviction was overturned on appeal in December 2025. (He declined my requests to interview him.)"
More specifically, he was charged of a data protection crime (i.e., note that in Finland these GDPR-like things are also in the criminal law). However, based on local news, I suppose there was not enough evidence that it was specifically a responsibility of a CEO or that CEO-level gross negligence occurred.
According to this report [1] the appeal was about specific requirements like encryption, and he claimed he had delegated it. So it is clear that it is hard to actually hold people responsible.
> The appellate court rejected the prosecution's argument and dismissed all charges. In its unanimous decision, the court stated that neither the GDPR nor the applicable Finnish healthcare legislation required encryption or pseudonymisation of patient data at the time in question.
> Prosecutors alleged that Tapio knew about the March 2019 breach and failed to act. They claimed he neglected legal obligations to report and document the incident and did not take sufficient steps to protect the database. Tapio denied the claims, saying he was unaware of the breach until autumn 2020 and had delegated technical oversight to external IT professionals.
> The court found there was no clear legal requirement at the time obliging Tapio, as CEO, to take the specific security measures cited by the prosecution. These included firewall management, password policies, access controls, VPN implementation, and security updates.
> According to the ruling, the failure to adopt such measures did not, in the court’s view, constitute criminal negligence under Finnish law.
> Tapio’s conduct during and after the 2019 breach did not meet the threshold for criminal liability, the court concluded.
[1] https://www.helsinkitimes.fi/finland/finland-news/domestic/2...
No, it’s just that it’s crazy to hold the CEO liable for absolutely everything that can go wrong.
> “absolutely everything”
It isn’t absolutely everything, it’s for negligence. If you don’t have basics in place, like independent pen-tests, ISO 27001 audits — or some equivalent — when you’re handling clinical data, then that’s negligence.
If a breach happens and you were seen to have followed best practice, you won’t be found criminally negligent.
That is part of being an executive. The buck stops with you — if you’re an executive, you’d better understand your obligations, you get the big bucks for a reason, it isn’t just a fancy job title.
Other people in the organisation can be held accountable for criminal acts, but when it comes to criminal negligence, it’s the executives that are liable, because it’s a systemic failure and you’re deemed to be in-charge of the system.
3 replies →
But this is not “absolutely everything”. No one is saying CEOs should be accountable for every action of an individual employee.
So if not the CEO, who is accountable when something like this breach happens? The CTO? The PM The DBA? Nobody? Maybe they’ll care developer who wrote the code or botched the configuration should be prosecuted?
CEOs can justify their pay be being accountable for what their company does. They’re the CEO, after all. Maybe they’ll care more when they have some actual skin in the game.
5 replies →
Is it sane to reward them for almost absolutely everything that goes right? Because that's the status quo for this position.
Privatize the gains and socialize the losses. egh?
The CEO is responsible for ensuring that there is a routine for security.
If that is not created -> CEO responsibility.
If that is not followed -> top level mgmt responsibility.
And so on, further down the chain.
Well this is why they get paid so much isn't it? Because they carry the responsibility.
So who?
It's normally the company directors that are personally liable.
Funny whenever people complain about the GDPR here they're thinking they would be slapped with a €20Mi fine and that EU team 6 is going to parachute in their office and arrest everyone
So they're saying this is not the case?
Well, not for public bodies at least: “ Administrative fines cannot be imposed on public organisations, such as the government or state-owned companies, municipalities and parishes” [1]
But luckily this sort of thing never happens in the public sector. Except for when it does: https://yle.fi/a/74-20094950
[1] https://tietosuoja.fi/en/corrective-powers
That's interesting, because if you go here https://www.enforcementtracker.com/ there are a lot of public institutions being hit with fines (if they are enforced it's another issue) - search for Municipality for example
However I don't see any municipality in Finland getting fines
1 reply →
The law is written such that they could do all that to a small family business that forgot to delete their Apache logs, which isn't good and leaves room for abuse even if they pinkie swear it's only meant for big violations.
Only after informing you, giving you the opportunity to fix things and many many other steps. The harshness is directly related to the size of the company and the companies willingness to fix any issues. They want companies to comply.
Reading the words and interpreting the law in its wider legal context are two different things
> So they're saying this is not the case?
Yes it was. The company was fined 20M EUR on standard GDPR-basis and went bankrupt (but unlikely due to the fine alone). Please re-read the above discussion.
The GDPR fine was 608k https://www.edpb.europa.eu/news/national-news/2022/administr...
1 reply →