Dun & Bradstreet Finland Oy – Violation Found (Finland, 2026)

Dun & Bradstreet Finland Oy (the controller) is a credit information agency. It maintained a credit information register containing data on natural persons and businesses, as well as a contact information and personal marketing register. Data subjects emailed the controller requesting access to their personal data and information on the processing of their data. The controller replied with a standard email. It told them to use OmaData, its personal data access portal. It did not respond to the requests otherwise or take any further measures to implement them. The controller’s website stated that access was free once within a 12-month period. If a data subject requested access more than once within that period, the controller would charge EUR 9.90. This applied to requests concerning credit data. The DPA received several complaints between May 2018 and June 2021. It then opened an ex-officio investigation into the controller’s handling of access requests and its fee practice. The DPA held that the controller failed to respond properly to the data subjects’ requests and charged an unlawful fee for access requests. It breached Articles 12(2), (3), (4), (5), and 15(4) GDPR. The DPA issued the controller a reprimand and an order to bring its procedures into compliance when implementing the data subjects’ right of access. 1. The controller failed to properly respond to access requests In response to requests for access, the DPA found that the controller merely directed data subjects by email to the OmaData service. The controller did not inform data subjects, as required by Article 12(3) GDPR, what measures it would take in response to the request; nor did it inform the data subjects that it would not take action on the request. The DPA reasoned that this could reasonably lead data subjects to believe that access to their data was available only through OmaData. If data subjects did not wish to use that service, they had to contact the controller again. The controller therefore failed to facilitate the exercise of data subject rights, contrary to Article 12(2) GDPR. 2. Unlawful fee for further access requests within 12 months without an individual assessment The DPA found that the controller systematically charged a fee when a data subject requested access more than once within a 12-month period. The controller argued that repeated requests could be charged under the Credit Information Act as requests for a credit information extract. The DPA rejected this because the GDPR right of access and the right under national law to obtain a credit information extract have different purposes. A controller cannot avoid the GDPR rules on free access to personal data by treating an Article 15 request as a paid request for an extract. In addition, the controller did not assess, on a case-by-case basis, whether the request was repetitive, manifestly unfounded or excessive. The DPA noted that, in credit information activities, data may change more than once a year, so a further request within 12 months may be justified unless the controller can demonstrate otherwise. The controller also did not consider whether the later request was a new request or merely a request for an additional copy. The DPA found that by applying the fee automatically, without examining the content and scope of the request, the controller made it more difficult for data subjects to exercise their rights as data subjects, which breached Article 12(5) and 15(4) GDPR.