- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 10048/182/20 – Violation Found (Finland, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Finnish email service provider denied a user's request to access their data in a machine-readable format. This matters because it highlights the importance of companies fulfilling user requests for data portability under GDPR, which can affect how businesses manage user data.
What happened
The email service provider refused a user's request to export their data in a structured format.
Who was affected
The user of the email service who wanted to access their personal data.
What the authority found
The DPA found that the email service provider did not properly fulfill its obligations under GDPR regarding data portability.
Why this matters
This case emphasizes that companies must take user data requests seriously and ensure they have the tools to comply with GDPR. Businesses should review their data export processes to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A registered user of an email service (the data subject) requested their data from the email service provider (the controller) in a structured, commonly used, and machine-readable format pursuant to Article 20 GDPR. The controller denied the request, stating that the data subject could export their emails one by one in an '.eml format'. Furthermore, the controller argued that it is still uncertain whether Article 20 GDPR applies to emails. The controller stated to be in the process of developing an import/export -tool. The tool was not yet available to all users, at the time. The data subject requested the Finnish DPA to investigate whether the controller had fulfilled its obligations under Article 20 GDPR. The DPA requested an explanation from the controller aiming to understand how the controller facilitated the right to data portability in relation to the email service. Furthermore, the DPA sought to determine whether the controller treated this right differently based on whether the user paid for the service or not. According to the controller, their intention was to provide data import and export tools for all users. However, due to technical reasons, such as encryption technologies, users had to perform these tasks manually themselves. The controller said to have been working on an automated tool to facilitate mass data export. However, they explained that they were unable to offer it to the entire user base due to technical and development-related challenges. Initially, access to the tool was limited to users with a subscription as a beta version, allowing for testing its stability and functionality on a progressively larger scale. Following the DPA's request, the tool was made available to free plan customers as well. The version released to them was the same one that had been available to paid customers for over a year. The data subject argued that the controller intentionally delayed fulfilling its obligations under the GDPR until an investigation by the
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 10048/182/20 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 10048/182/20 - Finland (2023). Retrieved from cookiefines.eu
Last updated: