DPA case 2025/AR/253 – Violation Found (Finland, 2025)

The Digital and Population Data Services Agency (DVV) provided digital services to Finnish residents. Under Finnish law, DVV was required to use the State Center for Information Technology (Valtori) for ICT infrastructure. Valtori acted as DVV’s processor under Article 28 GDPR and used Amazon Web Services (AWS) as a sub-processor to host cloud services. The Deputy Data Protection Ombudsman examined whether this arrangement involved international transfers of personal data and whether DVV had ensured compliance with Articles 24, 28 and 46 GDPR. Valtori confirmed that AWS could transfer personal data to third countries, including the United States, in connection with technical support and maintenance. Valtori relied on the European Commission’s Standard Contractual Clauses (SCCs) and had conducted a transfer impact assessment, which nevertheless identified residual risks of access by U.S. authorities. DVV had no direct contractual relationship with AWS, did not verify the data flows itself, and relied entirely on Valtori’s assurances regarding compliance. The Deputy Data Protection Ombudsman held that Valtori acted as DVV’s processor and AWS as its sub-processor, and that the processing involved international transfers of personal data within the meaning of Chapter V GDPR. The Ombudsman found that DVV, as the controller, remained responsible for ensuring that such transfers complied with GDPR, including Articles 44 and 46. DVV had not adequately assessed or documented the risks associated with transfers to the United States, including the implications of U.S. intelligence laws, and had not implemented sufficient complementary safeguards. Standard contractual clauses (SCCs) alone were considered insufficient to guarantee EU-level protection. Although the contract between DVV and Valtori required prior written consent for transfers outside the EU/EEA, DVV did not fully enforce this requirement. The Ombudsman issued a reprimand and ordered DVV to assess, document, and