- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 9024/181/19 – Complaint Upheld (Finland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A cleaning company in Finland used WhatsApp to share sensitive client information, including door codes, with its employees. The Finnish Data Protection Authority found this practice risky and not compliant with data protection rules. This case shows that businesses must be careful about how they share personal data.
What happened
The cleaning company disclosed personal client data through WhatsApp without proper safeguards.
Who was affected
Clients whose personal information, including door codes, was shared via WhatsApp.
What the authority found
The Finnish DPA determined that the company failed to ensure the security and confidentiality of personal data shared through WhatsApp.
Why this matters
This case highlights the need for companies to use secure methods for sharing sensitive information. Businesses should evaluate their communication practices to protect client data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A cleaning company (the Company) was relying on WhatsApp instant messaging services to communicate to its employees information about its clients, including their name, address, telephone number, and in some instances, even the door code or key box code of its clients' home. On 21 November 2019, a complaint was lodged with the Finnish DPA on the ground that the disclosure of such personal data via WhatsApp messages was in breach of the GDPR, and in particular of the principle of integrity and confidentiality, and security obligations. The Finnish DPA started an investigation, and asked the Company to clarify its data processing practices. The Company stated that it had changed its policy in connection with the investigation, and that it would only use WhatsApp messages to provide location information, i.e. the names and addresses of customers. The Company further stated that more sensitive information, such as door codes, are now communicated orally to its employees. The Company also stated that all former employees have already been instructed and reminded to delete all past communications containing customers' personal data. The Finnish DPA first considered that the Company had used WhatsApp without informing its customers thereof, to transmit customer data, including door codes and key box numbers, and that such disclosure could cause clear inconvenience to the customers. In particular, the Finnish DPA pointed out that the Company had no means of controlling the use of personal data via WhatsApp, or otherwise imposing restrictions on such use. In addition, the Finnish DPA considered that the Company should have taken all potential risks into account, such as the possibility that employees would lose their phones, and that customers' personal data could then become accessible to third parties. Although the Company had instructed former employees to remove all communications, the Finnish DPA noted that the Company had no means to verify if and when former employe
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 9024/181/19 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 9024/181/19 - Finland (2021). Retrieved from cookiefines.eu
Last updated: