Helsingin kaupunki (City of Helsinki) – Complaint Upheld (Finland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish Data Protection Ombudsman found that the City of Helsinki collected more personal data than necessary from volunteers applying to work with children. The city must now change its data practices to comply with GDPR rules.
What happened
The City of Helsinki collected excessive personal data from volunteer applicants beyond what was necessary for criminal background checks.
Who was affected
Volunteers applying to work with children and youth in Helsinki were affected by the city's extensive data collection.
What the authority found
The Finnish DPA ruled that the City of Helsinki's data collection practices were excessive and not in line with GDPR requirements.
Why this matters
This decision highlights the importance of data minimization, reminding organizations to only collect data that is necessary for their stated purpose. It also emphasizes the need for public entities to review their data processing practices to ensure compliance with privacy laws.
GDPR Articles Cited
National Law Articles
Data subject has requested the Finnish Data Protection Ombudsman's opinion on the lawfulness of the processing of their personal data by the City of Helsinki's Social services and healthcare division. As a part of an application process to volunteer as a support person for children and youth, the data subject has given consent to the data controller to obtain the applicant's criminal record from the police, in accordance with national rules regarding criminal background investigation of volunteers working with minors. It was then discovered that the City of Helsinki has systematically processed extensive personal data of the applicants, not limited to criminal record but wide-ranging data from the data subject's police records, such as cases where data subject has been in claimant's role. Lawfulness of processing of personal data related to the investigation of criminal background of applicants seeking to volunteer as a support person for children and/or youth. The DPA held that the personal data processed exceeded what was necessary and relevant for the original purpose of the processing. Deputy Data Protection Ombudsman ordered the City of Helsinki, the data controller, to correct its data processing practice in accordance with the GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Helsingin kaupunki (City of Helsinki) in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Helsingin kaupunki (City of Helsinki) - Finland (2021). Retrieved from cookiefines.eu
Last updated: