DPA case TSV/206/2022 – Violation Found (Finland, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A bus operator published its drivers' personal phone numbers on an internal website without clear justification. The Finnish DPA found that the operator's reasoning for sharing this information did not meet the necessary legal standards. This case serves as a reminder for companies to carefully consider the necessity of sharing personal data among employees.
What happened
The bus operator published personal phone numbers of its drivers on the company intranet without a valid reason.
Who was affected
The bus drivers whose personal phone numbers were published were affected.
What the authority found
The DPA determined that the bus operator did not provide sufficient justification for processing the personal phone numbers of its drivers, violating GDPR requirements.
Why this matters
This ruling highlights the need for companies to ensure that any sharing of personal data among employees is truly necessary for their work, reinforcing the importance of data protection in the workplace.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that a bus operator (the controller) had published the personal phone numbers of its bus drivers on the company intranet, although the drivers also had a personal business phone provided by the controller. The DPA then asked the controller to explain the purpose for which it processed the personal phone numbers of its drivers. In response to the request, the controller clarified that it published the personal phone numbers of its drivers in the company's intranet telephone directory because it was necessary for the drivers to be able to communicate with each other by phone while on duty. The controller emphasised that each employee had a personal password for the intranet in order to ensure the technical protection of personal data. In the controller's view, the processing was based on Article 6(1)(b) GDPR, as it was necessary for the performance of the employment contract. Regarding the separate business phones, the controller stated that they were primarily intended for mobile data use only, as the use of the phone was restricted so that it could only be used to make calls to specifically authorised numbers, such as supervisors and emergency numbers. It was therefore impossible to communicate with other drivers during the working day using only the business phone. First, the DPA noted that when processing the personal data of its employees, the employer must take into account the necessity requirement of [https://www.finlex.fi/fi/laki/ajantasa/2004/20040759#L2P3 Section 3 of the Finnish Act on the Protection of Privacy in Working Life], according to which the employer may only process personal data that is directly necessary for the employee's employment relationship, that is related to the exercise of the rights and obligations of the parties to the employment relationship or benefits provided by the employer to the employee, or that arises from the specific nature of the work concerned. On the basis of the information provided by t
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/206/2022 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/206/2022 - Finland (2024). Retrieved from cookiefines.eu
Last updated: