DPA case 9492/153/22 – Dismissed (Finland, 2022)

The parent of a minor child (the data subject), who was not their legal guardian, submitted a rectification and deletion request to the controller with regards to recorded information about the data subject which did not correspond to the factual situation. The parent attached a court form confirming the right to access information about the data subject. Although not clear from the decision itself, it seems that the controller refused to comply with the rectification and deletion request. Subsequently, the parent filed a complaint with the Finnish DPA. During the course of the opened proceedings, the DPA contacted the controller but did not request more information from the parent. The Finnish DPA recalled that Article 16 GDPR provides for the data subject's right to have incorrect data rectified while Article 17 GDPR grants the data subject the right to have incorrect data deleted. The DPA referred only to national law when establishing who has the right to exercise data subject rights on behalf of a minor child. In this regard, the DPA noted that [https://www.finlex.fi/en/laki/kaannokset/1983/en19830361.pdf Section 4 Subsection 4 of the Child Custody Act] stipulates that, as a general rule, the legal guardian represents the child in a matter concerning that person. However, according to Chapter 2, Section 9, Subsection 1, Clause 3 of the Child Welfare Act, the court can decide that a parent who is not the legal guardian, has the same right to receive confidential information about the child from authorities and private service providers. In this case, the DPA held that data subject rights under Articles 15-22 GDPR can only be exercised on behalf of the minor child by their legal guardian. The DPA noted that, although the parent had a court form confirming the right to access the data subject's personal data, this right did not extend to the right to request rectification or deletion of said personal data. In conclusion, the DPA rejected the complaint by sta