DPA case 7587/163/20 – Complaint Upheld (Finland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Finland's data protection authority upheld a complaint against a bank for not deleting a former customer's data when requested. The bank failed to comply with the customer's requests and did not provide necessary information about the deletion process. This case is important because it reinforces the right of individuals to have their data removed when it is no longer needed.
What happened
A bank was found to have violated GDPR by not deleting a former customer's data upon request.
Who was affected
The affected person was a former customer of the bank who requested data deletion.
What the authority found
The authority ruled that the bank violated GDPR by not complying with the customer's right to data deletion and failing to provide required information.
Why this matters
This case highlights the importance of respecting customers' rights to their data. Businesses must ensure they have clear processes for handling data deletion requests to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 28 September 2020, the data subject filed a complaint with the Finnish DPA against a bank (the controller) where they used to be a customer. On multiple occasions, the data subject had requested the controller to delete their data which was no longer necessary for processing after they ceased being a customer. However, the controller did not comply with the requests and did not provide the data subject with the required information under Articles 12(3) and 12(4) GDPR. When responding to the DPA, the controller explained that the violation happened because of a human error in the customer service department. The controller subsequently complied with the data subject's deletion request. The DPA held that the controller violated Article 17(1)(a) GDPR by not complying with the data subject's right to have their data deleted. Instead, the controller should have deleted the data to the extent that it was no longer necessary to store it. Additionally, the controller violated Articles 12(3) and 12(4) GDPR by providing the data subject neither with information on the measures taken in response to the request nor with the reasons for not taking any actions. As a result, the DPA reprimanded the controller.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 7587/163/20 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 7587/163/20 - Finland (2022). Retrieved from cookiefines.eu
Last updated: