DPA case 3116/163/20 – Violation Found (Finland, 2023)

On April 2020 an early childhood education unit (pre-school) sent an inquiry along with an informational letter regarding activities to prevent the spread of COVID-19. The families were asked to return the form, providing personal data (including the child's social security number) and stating whether they could arrange childcare at home during the pandemic. A letter accompanying the inquiry form stated that handling personal data is based on consent and that the data subject gives consent by returning the form. In reality many parents were told that returning the questionnaire was mandatory. The controller responded to the DPA's request for information, stating that returning the inquiry form was voluntary but strongly desirable. The information was needed to arrange activities during exceptional circumstances due to the COVID pandemic. The controller agreed that the voluntary nature of the inquiry could have been more clearly communicated. They also explained that employees had been given general guidelines for handling personal data, but not specific guidelines for this particular situation. The controller identified Article 6(1)(c) GDPR (necessary for compliance with a legal obligation) as the legal basis for the processing of personal data in this case. Their statement asserted that they needed the information in order to arrange day care for children, accounting for the number of students learning from home, and to arrange lessons in small groups where possible. They also claimed that they required the information in order to refund families if a child was not attending the activities due to the pandemic. However, the controller agreed that a child's social security number was not a necessary piece of information, and that their age would have been enough to verify the identity of the child. The DPA considered whether data subjects were informed in the survery of the purpose and legal basis of the processing of personal data, and the voluntariness of resp