DPA case 2368/182/20 – Complaint Upheld (Finland, 2021)

The Finnish Office of the Data Protection Ombudsman received a complaint "according to which a press release issued by the housing company in March 2020 stated that a resident diagnosed with coronavirus is obliged to inform the property manager". The DPA asked the housing company for clarification as it was understood to be the controller in this case. It responded that infections should be reported to improve cleaning services it provided. It did not intend to collect residents' health data and no cases were reported. The DPA held that no processing basis had been defined by the company for the processing of residents' personal data concerning coronavirus infections. It laid out the rules for general processing of personal data regarding residents by a housing company, and emphasised that coronavirus infection information is health information in accordance with Article 4(15) GDPR, and thus belongs to a specific category of data per Article 9(1) GDPR. It found that the controller had neither: * made an assessment of whether it could collect residents' health data in the present case; * assessed in a timely manner whether there was a legal basis for the processing of such personal data; * evaluated whether this processing would conflict with the principle of data minimisation under Article 5(1)(c) GDPR; * checked this requirement again that for built-in and default data protection in line with Article 25 GDPR. Thus, it issued a warning against the company. It considered the exercise of other coercitive powers unnecessary since no data had actually been collected.