Espoon kaupunki – Violation Found (Finland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Espoon kaupunki used Google’s digital learning tools in schools without getting consent from students' parents. The data protection authority found that the city could potentially justify this use under a legal obligation to provide education. This case highlights the importance of understanding consent when using digital tools in education.
What happened
Espoon kaupunki processed students' personal data using Google applications without parental consent.
Who was affected
Students and their parents whose data was processed through Google’s digital learning tools.
What the authority found
The data protection authority ruled that Espoon kaupunki might have a valid legal basis for processing personal data under GDPR, but further review was needed.
Why this matters
This case shows that schools must carefully consider consent when using digital tools. It sets a precedent for how educational institutions can justify data processing under legal obligations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Secondary-source text retrieved.
Automated check recorded — 29 September 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked Article 6(1)(c) GDPR as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the [https://www.finlex.fi/fi/lainsaadanto/1998/628 Finnish Basic Education Act]. The DPA issued a decision in case 1509/452/18 in December 2021. This decision was appealed to the Supreme Administrative Court, which referred the case back to the DPA in its decision KHO:2025:29 in April 2025. The Supreme Administrative Court held that the DPA could not conclude Article 6(1)(c) GDPR was not applicable in any respect as a legal basis for the processing. In the present proceedings, the DPA was to decide the extent to which the controller could invoke the compliance with a legal obligation as a legal basis for the processing of personal data related to the use of Google’s digital learning tools. The DPA ordered the controller to ensure that the personal data of pupils collected in connection with the use of Google's digital learning tools was solely processed for the purpose of fulfilling the controller's educational obligations. The processing could be based on Article 6(1)(c) GDPR only under these conditions. The DPA held that the controller could invoke Article 6(1)(c) GDPR as a legal basis for the use of learning tools essential to teaching. In addition, the processing must be carried out solely to fulfill educational obligations. The DPA pointed out that this legal basis applies to the use of tools that are central to teaching, such as text editors,
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Espoon kaupunki in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Espoon kaupunki - Finland (2026). Retrieved from cookiefines.eu
Last updated: