- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case TSV/35/2022 – Violation Found (Finland, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Finnish educational institution processed student data without consent for marketing purposes. This is important because it shows that schools must protect student privacy and not share their information without permission.
What happened
The educational institution processed students' personal data to promote third-party courses without their consent.
Who was affected
Students whose personal data was used for marketing without their permission.
What the authority found
The DPA found that the institution violated GDPR by disclosing personal data without a legal basis.
Why this matters
This ruling highlights the need for educational institutions to train staff on data protection and ensure they have consent before using student information for marketing.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that a municipality-run educational institution (the controller) processed the personal data of its students for the marketing of courses offered by a third party without the consent of its students. The DPA asked the controller to explain the purpose of the personal data processing. In response to the request, the controller clarified that a teacher had sent the students an email in which the teacher advertised their own course in another organisation. The controller emphasised that sending the email in question was not related to the activities of the controller. The controller claimed that the email in question had been sent against the controller's instructions. According to the controller's privacy notice, personal data was not disclosed to third parties for direct marketing. On the basis of the information provided by the controller, the DPA considered that the email sent from the controller's information system was promoting services offered by another organisation and that such use of the personal data was comparable to disclosure. The DPA emphasised that in accordance with Article 32(4) GDPR, the controller must ensure that its employees have sufficient understanding and competence regarding the processing of personal data and data protection. The DPA stated that the controller must also comply with [https://www.finlex.fi/fi/laki/ajantasa/1999/19990621#L4P16 Section 16(3) of the Finnish Act on the Openness of Government Activities], according to which the disclosure of personal data for direct marketing requires the data subject's consent. Since there was no legal basis to disclose the students' personal data, the controller processed the personal data in violation of the lawfulness principle. On the basis of the information gathered, the DPA held that the controller had violated Article 5(1)(a) GDPR, as the processing of personal data was not related to the activities of the controller and there were no legal grounds for the
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/35/2022 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/35/2022 - Finland (2023). Retrieved from cookiefines.eu
Last updated: