City of Helsinki – Court Ruling (Finland, 2022)

The social and health authority of the city of Helsinki (the controller) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the background information of applicants applying to volunteer as a child support person. The controller filed the appeal claiming that the processing of personal data was necessary to comply with its legal obligations under Article 6(1)(c) GDPR. The controller claimed that [https://www.finlex.fi/fi/laki/ajantasa/2014/20141301 the Finnish Social Welfare Act] and [https://www.finlex.fi/fi/laki/ajantasa/2007/20070417 the Finnish Child Welfare Act] oblige and entitle it to extensively process the background information of support person applicants, on the basis of which it can be assessed if they pose a threat to the child's physical and psychological integrity. The Court agreed with the controller that determining the background of volunteers working with children could be considered necessary in order to fulfil its obligations under [https://www.finlex.fi/fi/laki/ajantasa/2014/20141301 the Finnish Social Welfare Act] and [https://www.finlex.fi/fi/laki/ajantasa/2007/20070417 the Finnish Child Welfare Act]. However, the Court noted that pursuant Article 6(2) GDPR, the processing of personal data related to the organisation of support person activities is regulated in more detail in [https://www.finlex.fi/fi/laki/ajantasa/2002/20020504#P5 Section 5 of the Finnish Act on Checking the Criminal Background of Persons Working with Children], according to which the municipality may only request an extract from the criminal record from the applicant. In light of this, the Court agreed with the DPA that the personal data processed by the controller had exceeded what was necessary and relevant for the original purpose of the processing, therefore violating Article 6 GDPR and Article 10 GDPR.