- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 6609/163/19 – Complaint Upheld (Finland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Finnish Data Protection Authority upheld a complaint against a photography company for including children's pictures on invoices. The authority found this practice unnecessary and a violation of data minimization rules. This ruling emphasizes the need for companies to only collect and use data that is essential.
What happened
A company printed children's pictures on invoices sent to parents, which was deemed unnecessary.
Who was affected
The complaint was made by a parent whose children's pictures appeared on the invoices.
What the authority found
The authority ruled that the company violated data minimization principles by including unnecessary images on invoices.
Why this matters
This decision highlights the importance of only using necessary data in business practices. Companies should review their data collection methods to ensure compliance with privacy laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finish DPA rendered a decision in a case opposing a parent (the applicant) to a company specialized in kindergarten and school photography (the controller). The applicant complained about the fact that a picture of his children was appearing in miniature on the invoice sent by the controller. The Finish DPA ruled that including a miniature of the children's pictures on the invoice was not necessary for the purpose of payment or security, and that the controller had therefore infringed the principle of data minimization enshrined in Article 5(1)(c) GDPR. The Finish DPA further ordered the controller to bring its processing activities into compliance under Article 58(2)(d) GDPR. The controller is a Finish company specialized in taking pictures of children at kindergarten and schools. The controller was printing and sending pictures of about 400,000 pupils each year. For several years, the controller had adopted a practice consisting in printing a miniature of the pictures on the invoice to be sent to the parents. After receiving an invoice on which a miniature of his children's picture was printed, a parent decided to contact the customer service of the controller to complaint about that practice. The controller did not agree with the parent. As a consequence, the parent lodged a complaint with the Finish DPA. The dispute concerned whether or not printing the children's pictures in miniature on the invoice was complying with the GDPR, and in particular with the principle of data minimisation enshrined in Article 5(1)(c) GDPR. According to the company, printing the pictures in miniature on the invoice was enabling its employees to make sure that the correct pictures and invoices were sent together to each customer. The controller also argued that such a practice was justified from the point of view of data security. According to the parent, such practice was not necessary for the purposes pursued by the controller, and violated the principle of data minimisatio
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 6609/163/19 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 6609/163/19 - Finland (2021). Retrieved from cookiefines.eu
Last updated: