DPA case TSV/12/2019 – Complaint Upheld (Finland, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish data protection authority upheld a complaint against a telecommunications operator for not providing complete personal data to a user. This matters because it emphasizes the importance of transparency and user rights in accessing their data.
What happened
A telecommunications operator refused to provide a complete copy of personal data requested by a user.
Who was affected
A user of the telecommunications service who requested access to their personal data.
What the authority found
The authority found that the operator had not fully facilitated the user's rights to access their data.
Why this matters
This case highlights the need for companies to ensure they are fully transparent and responsive to user data requests. Businesses should improve their processes for handling data access requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that a telecommunications operator (the controller) had refused to provide a copy of the personal data generated by the use of the data subject's mobile phone by email and had partially refused to provide traffic data. The DPA then asked the controller to explain how it facilitated the exercise of data subject rights. In response to the request, the controller clarified that it had provided the data subject with the bill breakdown and the location and base station information, as the data subject had not specified that the access request concerned other traffic data. The controller emphasised that it could not provide all traffic data because, for example, the invoice breakdown shall not include the traffic data of free calls according to [https://www.finlex.fi/fi/laki/ajantasa/2014/20140917#O5L16P134 Section 134 of the Finnish Act on Electronic Communications Services]. The controller also stated that the data subject could view their personal data on the controller’s online service, which is accessed through electronic authentication. The contact details provided by the data subject did not allow the controller to verify the data subject's email address, and the controller did not consider the email address to be secure. Therefore, the controller had provided the personal data in the form of a letter, which ensured that the data would be delivered to the correct recipient without violating the confidentiality of the communication. The data subject claimed that not all the personal data processed by the controller were available on the controller's online service. Furthermore, the controller had not asked the data subject to provide additional information in order to provide the data by email, and had not informed the data subject that it was unable to verify their email address. On the basis of the information provided by the controller, the DPA considered that the Finnish Transport and Communications Agency had supervisory competenc
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/12/2019 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/12/2019 - Finland (2024). Retrieved from cookiefines.eu
Last updated: