DPA case TSV/5875/2024 – Violation Found (Finland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An insurance company faced scrutiny for mishandling e-invoices, which led to one customer's personal information being sent to another. The Finnish DPA found that the company failed to protect personal data properly. This ruling emphasizes the need for companies to implement strong security measures to safeguard user data.
What happened
An insurance company mistakenly sent e-invoices containing personal information of one customer to another due to a system error.
Who was affected
The customers involved were data subject A, who received the wrong invoices, and data subject B, whose information was disclosed.
What the authority found
The DPA ruled that the insurance company's e-invoice system violated GDPR rules on data protection and security.
Why this matters
This case serves as a reminder for companies to integrate data protection measures into their systems to prevent unauthorized access to personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
An insurance company (the controller) launched its e-invoice system in 2012. It conducted functionality tests and maintained a process to flag reference numbers that failed to link to any existing agreement. When the system was updated in 2013, the controller did not implement measures to verify the reference numbers. In April 2013, a data subject (data subject A) changed their e-invoice agreement but entered the wrong reference number. Because this incorrect number belonged to another data subject (data subject B)’s contract, data subject B’s e-invoices were automatically directed to data subject A's online bank. This resulted in the disclosure of data subject B's name, address, contract number, insurance details, and payment plans. This unauthorised access persisted from April 2013 until January 2024, involving approximately 130 invoices. Although the controller implemented internal check digit verification in 2020 to prevent future errors, this specific instance of unauthorised access remained undetected until 2023 and was reported to the DPA in May 2024. Furthermore, following a 2021 DPA ruling, the controller committed to implementing a second identifier for identity verification, with full implementation scheduled for late 2025. The DPA held that the controller’s e-invoice ordering procedure violated Articles 5(1)(f) and 25(1) of the GDPR and issued a formal reprimand. The DPA reasoned that a controller is legally obligated to ensure the security of personal data through appropriate technical measures, integrating data protection into the system "by design and by default." These measures must be implemented both prior to and throughout the processing period, with the controller continuously evaluating the effectiveness of the selected safeguards. In this case, the DPA found that relying solely on an unverified reference number was insufficient to prevent unauthorised access. The DPA emphasised that the breach could have been avoided if the check digit had
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/5875/2024 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/5875/2024 - Finland (2026). Retrieved from cookiefines.eu
Last updated: