- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case TSV/224/2023 – Violation Found (Finland, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A first aid training provider was found to have made it difficult for a person to access their personal data. The Finnish Data Protection Authority ruled that the provider's identification process was too strict and not reasonable. This ruling serves as a reminder for businesses to make it easier for individuals to exercise their data rights.
What happened
The training provider required a signed form and ID to grant access to personal data, which the person did not provide.
Who was affected
The individual who requested access to their personal data from the training provider.
What the authority found
The authority determined that the provider's method of verifying identity was not reasonable and hindered the person's right to access their data.
Why this matters
This case shows that companies must facilitate data access requests without imposing unreasonable requirements. Businesses should review their processes to ensure compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that a provider of first aid training ("controller") had requested the data subject to submit by email a signed form and a copy of their ID in order to exercise the right of access. The data subject made an access request but did not provide the filled in form and a copy of their ID. Therefore, the controller did not provide access to the personal data. The DPA had asked the controller to explain how it facilitated the exercise of data subject rights. In addition, the DPA also asked the controller to clarify how long it retained personal data. In response to the request, the controller clarified that it could not confirm the identity of the data subject because the access request had been submitted by email, which only contained the name and email address of the data subject. Therefore, the controller could not fulfill the request, because the data subject had not agreed to submit the signed information request form or to identify themselves as requested by the controller. Concerning the retention periods, the controller stated that the completed training was valid for three years and that the personal data would be erased two years after the end of the validity period. On the basis of the information provided by the controller, the DPA considered that the controller's method of identifying the data subject was not based on a case-by-case assessment and that requesting a copy of the identity document was a standard means of identification. The DPA emphasised that the controller's possibility to request additional information to confirm the identity of the data subject in accordance with Article 12(6) GDPR must not lead to unreasonable requirements and the collection of personal data that is not necessary to verify the connection between the data subject and the personal data requested. The DPA found that the controller had not facilitated the exercise of data subject rights in accordance with Article 12(2) GDPR, as the data subject an
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/224/2023 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/224/2023 - Finland (2024). Retrieved from cookiefines.eu
Last updated: