- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
City of Helsinki – Violation Found (Finland, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Finnish Data Protection Authority found that the City of Helsinki failed to establish a data processing agreement with a company managing an online pupil welfare service. This lack of agreement meant that the company was not bound to protect personal data. The case stresses the importance of proper contracts in data processing.
What happened
The City of Helsinki was found to have not signed a data processing agreement with the company managing its pupil welfare service.
Who was affected
Pupils using the online welfare service who were potentially at risk due to inadequate data protection measures.
What the authority found
The authority ruled that the City of Helsinki violated GDPR by not having a data processing agreement in place with the service provider.
Why this matters
This case emphasizes the necessity for organizations to have clear agreements with service providers to ensure data protection compliance. It serves as a reminder for all businesses to formalize their data processing relationships.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that the City of Helsinki (the controller) had not concluded a data processing agreement with the company that maintained an online pupil welfare service that allowed pupils to contact a school counsellor or school psychologist. The DPA then asked the controller to explain who was responsible for maintaining the service. In response to the request, the controller clarified that it had no contractual documentation with the company maintaining the service regarding roles or data protection. The controller also stated that it no longer used the company to operate the service and that the service was now maintained by the controller. On the basis of the information provided by the controller, the DPA considered that another company had carried out the regular maintenance of the online service on behalf of the controller and had thus acted as a processor of personal data. The DPA found that, in the absence of a data processing agreement between the parties, the company maintaining the service was not contractually bound, for example, to ensure security of processing or confidentiality. On the basis of the information gathered, the DPA held that the controller had violated Article 28(3) GDPR by failing to comply with its obligation as controller to enter into a data processing agreement with the processor. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for City of Helsinki in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. City of Helsinki - Finland (2023). Retrieved from cookiefines.eu
Last updated: