DPA case 1011/161/22 – Violation Found (Finland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Finnish school asked all students' guardians for bank account numbers to pay scholarships, even though not all students would receive them. The Finnish data protection authority found that the school unnecessarily collected this information, violating data minimization rules. This ruling reminds schools and organizations to only collect data that is truly needed.
What happened
A school requested bank account numbers from all students' guardians for scholarship payments, even though only some would receive them.
Who was affected
The guardians of all students enrolled at the school.
What the authority found
The Finnish data protection authority ruled that the school violated GDPR's data minimization principle by collecting unnecessary bank account numbers.
Why this matters
This ruling stresses the importance of collecting only the data that is necessary for specific purposes. Schools and organizations should evaluate their data collection practices to ensure compliance.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that a school (the controller) had requested the guardians of all its students to provide the students' bank account numbers for the payment of a possible scholarship. The DPA then asked the controller to explain for what purpose it processed the bank account numbers of all its students. In response to the request, the controller clarified that scholarships were usually physically awarded to the recipients at the end of the semester. Due to the pandemic, it was decided to pay the scholarship directly to the student's bank account. The controller also stated that it did not want to reveal in advance which students would receive the scholarships. Thus, to speed up the process, the controller requested the bank account numbers of all its students. On the basis of the information provided by the controller, the DPA considered that personal data shall not be processed and stored only for the sake of certainty and for future use. The controller had unnecessarily processed the bank account numbers of all its students for the purpose of awarding the scholarships, even though these would have been awarded only to some students. The DPA emphasised that it would have been possible for the controller to award the scholarships in a less intrusive manner and therefore the controller violated the principle of data minimisation enshrined in Article 5(1)(c) GDPR by processing the bank account numbers. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA also ordered the controller to erase the bank account numbers since there were no legal grounds for the processing.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 1011/161/22 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 1011/161/22 - Finland (2023). Retrieved from cookiefines.eu
Last updated: