DPA case TSV/428/2022 – Dismissed (Finland, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish DPA dismissed a complaint against an insurance company for not providing all requested documents. The company clarified that it had sent the requested information, which satisfied the DPA's requirements. This case shows that companies must communicate clearly with users about their data requests.
What happened
An insurance company was accused of not providing all documents requested by a customer.
Who was affected
A customer who requested access to their personal data from the insurance company.
What the authority found
The DPA ruled that the insurance company complied with GDPR by providing a transcript of the call and later sending the requested documents.
Why this matters
This case underscores the importance of clear communication between companies and their customers regarding data access requests. Businesses should ensure they provide accurate information to avoid misunderstandings.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Finnish DPA was notified that an insurance company (the controller) had not provided the data subject with all the requested documents, emails, call recordings and other possible material related to the customer satisfaction survey. Instead, the controller had only provided a transcript, which, according to data subject, differed from the content of the call. The DPA then asked the controller to explain how it had implemented the data subject's request. In response to the request, the controller clarified that it had provided the data subject with all the information requested by the data subject. The controller explained that, as the data subject had requested that the information be provided by post, the controller had provided the data subject with a transcript of the call, which reflected to the content of the call. The controller had then sent the call recording and other documents to the data subject by post on a flash drive. The data subject had asked the DPA to decide whether the transcript corresponded with the call recording with sufficient accuracy and whether the controller should have provided a copy of the call recording by post immediately or only upon the data subject's new requests. On the basis of the information provided by the controller, the DPA considered that the controller must assess, on a case-by-case basis, the appropriate format in which to provide the personal data requested under Article 15 GDPR. The DPA emphasised that personal data need not always be provided in the original format if the data can be properly provided in another form, such as, in writing. The DPA noted that the information provided by the controller enabled the individual to verify the accuracy of the personal data. Therefore, the DPA considered that the controller had complied with the requirements of Article 12(1) GDPR and Article 15(3) GDPR by first providing a written transcript of the call recording. With regard to the content of the call recording, the DPA
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/428/2022 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/428/2022 - Finland (2024). Retrieved from cookiefines.eu
Last updated: