DPA case TSV/2/2018 – Complaint Upheld (Finland, 2024)

The Finnish DPA was notified that a telecom operator (the controller) had refused to erase the data subject's personal data relating to their customer relationship. The DPA then asked the controller to explain why it had refused the erasure request and for how long it stored the personal data of its customers. In response to the request, the controller clarified that it could not comply with the data subject's request because the processing was necessary according to Article 17(3)(e) GDPR. The controller stated that, according to [https://www.finlex.fi/fi/laki/ajantasa/2003/20030728#P4 Section 4 of the Finnish Act on the Expiry of Debts,] the general expiry limit for debts is three years. Therefore, the controller could not erase the personal data because three years had not passed since the end of the customer relationship. The controller also stated that customer data older than three years should have been deleted from its systems through an automatic deletion process, which had not been done due to a technical error. However, the controller stated that it had manually deleted the data subject's personal data at a later stage. On the basis of the information provided by the controller, the DPA considered that the controller was entitled to store the data subject's personal data for three years after the end of the customer relationship. The DPA stated that if the controller deleted the data subject's personal data, it would not be able to defend itself against possible invoicing claims by customers or other creditors. However, the DPA found that the controller had still violated Article 17(3)(e) GDPR because, despite the data subject's request, it had not erased such personal data, which should have been removed from its systems even before the data subject's request. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR.