DPA case 6652/154/19 – Dismissed (Finland, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish data protection authority dismissed a complaint about a company refusing to erase a job applicant's data. They found that the company had a valid reason to keep the data for potential discrimination claims. This case is significant because it clarifies the balance between data retention and individual rights.
What happened
A company refused to erase a job applicant's personal data related to their recruitment process.
Who was affected
A job applicant whose request to delete their personal data was denied.
What the authority found
The authority ruled that the company was allowed to retain the data for two years to defend against possible discrimination claims.
Why this matters
This decision illustrates the complexities of data retention policies and the need for companies to justify their data storage practices. It emphasizes the importance of balancing individual rights with legal obligations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that a company ("controller") had refused to erase the data subject's personal data relating to their recruitment process. The DPA then asked the controller to explain why it had refused the erasure request and for how long it stored the personal data of its job applicants. In response to the request, the controller clarified that it could not comply with the data subject's request because the processing was necessary according to Article 17(3)(b) GDPR and Article 17(3)(e) GDPR. The controller stated that, according to [https://www.finlex.fi/fi/laki/ajantasa/1889/18890039001#L8P1 Chapter 8 Section 1(2)(4) of the Finnish Criminal Code], a work discrimination claim must be filed within two years. Therefore, the controller could not erase the personal data because two years had not passed since the end of the recruitment process. The controller also stated that it continued to process the job applicants' personal data for six months after the end of the two-year statute of limitations as a precautionary measure in order to be able to deal with discrimination claims if they were filed at the very end of the statute of limitations. On the basis of the information provided by the controller, the DPA considered that the controller was entitled to store the data subject's personal data for two years after the end of the recruitment process. The DPA stated that if the controller deleted the data subject's personal data, it would not be able to defend itself against possible discrimination claims. The DPA noted that according to [https://www.finlex.fi/fi/laki/ajantasa/1889/18890039001#L8P2 Chapter 8 Section 2(1) of the Finnish Criminal Code], the statute of limitations is calculated from the date when the offense is committed. In light of this, the DPA emphasised that it is not the date when the claim was filed that is relevant, but the date when the work discrimination took place. Thus, the DPA found that the controller could not store the pers
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 6652/154/19 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 6652/154/19 - Finland (2020). Retrieved from cookiefines.eu
Last updated: