DPA case TSV/5875/2024 – Violation Found (Finland, 2026)

An insurance company (the controller) launched its e-invoice system in 2012. It conducted functionality tests and maintained a process to flag reference numbers that failed to link to any existing agreement. When the system was updated in 2013, the controller did not implement measures to verify the reference numbers. In April 2013, a data subject (data subject A) changed their e-invoice agreement but entered the wrong reference number. Because this incorrect number belonged to another data subject (data subject B)’s contract, data subject B’s e-invoices were automatically directed to data subject A's online bank. This resulted in the disclosure of data subject B's name, address, contract number, insurance details, and payment plans. This unauthorised access persisted from April 2013 until January 2024, involving approximately 130 invoices. Although the controller implemented internal check digit verification in 2020 to prevent future errors, this specific instance of unauthorised access remained undetected until 2023 and was reported to the DPA in May 2024. Furthermore, following a 2021 DPA ruling, the controller committed to implementing a second identifier for identity verification, with full implementation scheduled for late 2025. The DPA held that the controller’s e-invoice ordering procedure violated Articles 5(1)(f) and 25(1) of the GDPR and issued a formal reprimand. The DPA reasoned that a controller is legally obligated to ensure the security of personal data through appropriate technical measures, integrating data protection into the system "by design and by default." These measures must be implemented both prior to and throughout the processing period, with the controller continuously evaluating the effectiveness of the selected safeguards. In this case, the DPA found that relying solely on an unverified reference number was insufficient to prevent unauthorised access. The DPA emphasised that the breach could have been avoided if the check digit had