- Enforcing jurisdiction
- Finland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case TSV/1319/2025 – Violation Found (Finland, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A real estate agency was found to have kept housing applicants' personal data for too long. The data protection authority ruled this violated rules about data minimization and storage limits. This case highlights the importance of keeping personal data only as long as necessary.
What happened
The real estate agency retained personal data from housing applications for 12 years instead of the required five years.
Who was affected
Housing applicants whose personal data was stored excessively by the agency.
What the authority found
The data protection authority found that the agency violated data protection rules by keeping applicants' data for too long.
Why this matters
This ruling emphasizes the need for businesses to regularly review their data retention policies. Companies should only keep personal data for as long as necessary to avoid legal issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA began investigating the storage periods of the personal data of housing applicants (the data subjects) contained in rental housing applications during a previous proceeding against the a real estate agency (the controller). This proceeding was initiated in December 2022 and concluded in February 2025. The controller stated in its submissions connected to the aforementioned case that it collected e.g. the personal identification number, information relating to employment, financial information, and other information needed to assess the applicants' ability to pay rent from the data subjects. The data subjects could also additionally choose to provide the controller a wide range of sensitive personal information about themselves. The controller retained the housing application data for 12 years in total in order to avoid potential liability for damages. In the present case, the DPA investigated whether the storage periods complied with the principles of data minimisation and storage limitation as well as the requirements for data protection by design and default. The controller estimated that there had usually been from a few to half a dozen damages claims per year, none of which had processed to a lawsuit filed in court in the past 12 years. In the year preceding the DPA investigation, the controller had received approximately 82,000 housing applications. National law requires real estate agencies to retain information related to housing applications for five years. According to the controller, data collected more than five years ago was only used to file or defend legal claims, or to comply with anti-money laundering legislation. The DPA held that the controller had violated the principles of data minimisation and storage limitation by systematically retaining all personal data contained in housing applications for 12 years. Furthermore, it found that the controller had failed to comply with the requirements of data protection by design and default laid d
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case TSV/1319/2025 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case TSV/1319/2025 - Finland (2026). Retrieved from cookiefines.eu
Last updated: