- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 9885/157/19 – Violation Found (Finland, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A telecommunications company in Finland faced scrutiny for making it hard for users to opt-out of direct marketing. A person complained that the only way to refuse marketing was through a complicated process. The Finnish data protection authority ruled that companies must make it easy for users to deny marketing communications.
What happened
The telecommunications company made it difficult for users to opt-out of direct marketing.
Who was affected
A user who wanted to refuse direct marketing from the telecommunications company.
What the authority found
The Finnish DPA ruled that the company did not provide an easy way for users to deny direct marketing, violating user rights.
Why this matters
This ruling emphasizes that companies must simplify the process for users to refuse marketing communications. It serves as a reminder for businesses to ensure user rights are respected.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject had tried to deny direct marketing carried out by a telecommunications company (the controller), but there was no direct way to do this in the direct marketing message they had received. The data subject also had difficulties finding the contact information of the data protection officer on the controller's website. According to the controller, direct marketing could have been denied in two ways: by contacting customer service or by creating an account in the online service. The contact information of the data protection officer, on the other hand, could have been found on the controller's website, layered behind three separate pages. In addition, the data subject could have called the controller's switchboard and asked to be connected to the data protection officer. The DPA stated that the requirement to sign in to an online service as the only possibility to deny direct marketing does not meet the requirement of ease of refusal according to [https://www.finlex.fi/fi/laki/ajantasa/2014/20140917#O7L24P200 Section 200(3) of the Finnish Act on Electronic Communication Services]. The DPA emphasised that the requirement of Article 12(2) GDPR should also have been taken into account in order to facilitate the exercise of the data subject's rights, such as the right to object according to Article 21 GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA ordered the controller to ensure that data subjects are given the opportunity to easily deny the use of their contact information for direct marketing purposes in connection with electronic direct marketing messages. With regard to the contact information of the data protection officer, the DPA considered that when the information provided to the data subject on the website is layered, for example, on different pages, the combined effect of the different pages is of paramount importance in order to ensure that the layered operating model does not increase confusion but reduces it. Thus, the DPA instructed the co
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 9885/157/19 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 9885/157/19 - Finland (2023). Retrieved from cookiefines.eu
Last updated: