DPA case TSV/5059/2023 – No Violation (Finland, 2026)

A pension insurance company (the controller) had disclosure the amount of an applicant's (the data subject's) pension accrual in euros to a physician who conducted a medical evaluation of the data subject in March 2023. The purpose of the evaluation was to decide whether the data subject was entitled to disability pension. The DPA investigated whether the controller had violated the principle of data minimisation laid down in Article 5(1)(c) GDPR and the obligation to implement appropriate technical and organisational measures under Article 25(2) GDPR. The controller argued that the physician needed information on the data subject's accrued pension benefits to be able to assess the data subject's ability to work. The physician conducting the medical evaluation generally receives data on the applicants' health status and employment history and gives a reasoned opinion on whether the conditions for granting disability pension are fulfilled. According to the controller, the physician must know the data subject's accrued pension benefits to assess their ability to work and determine whether the data subject would fall under the employment pension or the national pension system. The DPA held that the controller had not acted in violation of Articles 5(1)(c) and 25(2) GDPR by disclosing the data subject's accrued pension to a physician involved in processing the application for disability pension. According to the DPA, no facts had come to light in the present case that would justify the opposite conclusion. The DPA pointed out that information on the data subject's accrued pension was appropriate, relevant, and necessary for the processing of the pension application. It also argued that the physician acted under professional liability and was bound by a statutory duty of confidentiality. Finally, the DPA noted that it was in the data subject's best interest for the physician to know the exact amount of the data subject's pension accrual – the physician's evaluation a