DPA case 2025/AR/253 – Violation Found (Finland, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Finland's data protection authority reprimanded the Digital and Population Data Services Agency for not properly managing international data transfers to Amazon Web Services. This is significant because it highlights the responsibility of companies to ensure data protection when using third-party services.
What happened
The DPA found that the agency did not adequately assess risks related to transferring personal data to the U.S.
Who was affected
Finnish residents whose personal data was transferred to AWS through the agency's services.
What the authority found
The authority ruled that the agency failed to ensure compliance with GDPR regarding international data transfers.
Why this matters
This case serves as a reminder for organizations to thoroughly evaluate data protection measures when using external cloud services.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Digital and Population Data Services Agency (DVV) provided digital services to Finnish residents. Under Finnish law, DVV was required to use the State Center for Information Technology (Valtori) for ICT infrastructure. Valtori acted as DVV’s processor under Article 28 GDPR and used Amazon Web Services (AWS) as a sub-processor to host cloud services. The Deputy Data Protection Ombudsman examined whether this arrangement involved international transfers of personal data and whether DVV had ensured compliance with Articles 24, 28 and 46 GDPR. Valtori confirmed that AWS could transfer personal data to third countries, including the United States, in connection with technical support and maintenance. Valtori relied on the European Commission’s Standard Contractual Clauses (SCCs) and had conducted a transfer impact assessment, which nevertheless identified residual risks of access by U.S. authorities. DVV had no direct contractual relationship with AWS, did not verify the data flows itself, and relied entirely on Valtori’s assurances regarding compliance. The Deputy Data Protection Ombudsman held that Valtori acted as DVV’s processor and AWS as its sub-processor, and that the processing involved international transfers of personal data within the meaning of Chapter V GDPR. The Ombudsman found that DVV, as the controller, remained responsible for ensuring that such transfers complied with GDPR, including Articles 44 and 46. DVV had not adequately assessed or documented the risks associated with transfers to the United States, including the implications of U.S. intelligence laws, and had not implemented sufficient complementary safeguards. Standard contractual clauses (SCCs) alone were considered insufficient to guarantee EU-level protection. Although the contract between DVV and Valtori required prior written consent for transfers outside the EU/EEA, DVV did not fully enforce this requirement. The Ombudsman issued a reprimand and ordered DVV to assess, document, and
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025/AR/253 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025/AR/253 - Finland (2025). Retrieved from cookiefines.eu
Last updated: