DPA case 3592/152/2019 – Complaint Upheld (Finland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Finnish company was found to have denied a self-employed trader access to a recorded phone call. This ruling matters because it reinforces the right of individuals to access their personal data.
What happened
A self-employed trader requested access to a recorded phone call but only received a transcript instead of the audio.
Who was affected
A self-employed trader whose phone call was recorded by a company.
What the authority found
The Finnish Data Protection Authority ruled that the trader had the right to access the audio recording of the call, not just a transcript.
Why this matters
This case emphasizes that individuals have the right to access their personal data in its original format. Companies should ensure they provide data in the requested format when possible.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In the course of business, a private trader having the status of a self-employed person (the Complainant) had a phone call with a company (the Company) which was recorded by the latter. The Complainant later requested access to the recording of the phone call on the basis of Article 15 GDPR. The Company said that it could not provide a copy of the phone call in audio format, but instead provided the Complainant with a transcript of the recording in text format. The Complainant filed a complaint with the Finnish DPA, asking the latter to clarify whether the Company had the right to provide a written transcript of the recording of the call. = The Finnish DPA first examined whether the audio recording of a phone conversation consists of personal data in the sense of Article 4(1) GDPR. Referring to the wording of that Article, as well as to both Finnish and EU case-law, the Finnish DPA concluded that the voice of an individual must be considered as personal data. Referring to the [https://curia.europa.eu/juris/document/document.jsf;jsessionid=CF348584276C1D965A25A3329FDBF0CD?text=&docid=79001&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=3496143 CJEU judgment C-92-09 Volker und Markus Schecke], the Finnish DPA further stressed that the fact that the Complainant was acting in its capacity as a self-employed trader during the call did not change that finding. As explained in paragraph 53 of that CJEU judgment indeed, EU data protection law also applies to legal persons in so far as a natural person is identifiable as a legal person (as was the case here). As a consequence, the Finnish DPA concluded that the Complainant had a right of access to the recording in accordance with Article 15 GDPR. = The Finnish DPA then examined in which format the Company had to provide a copy of the personal data, in light of Article 15(3) GDPR. In this respect, the Finnish DPA noted that in some instances, personal data itself may impose an obligation to provide the data in
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 3592/152/2019 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 3592/152/2019 - Finland (2021). Retrieved from cookiefines.eu
Last updated: