Helsingin kaupunki (City of Helsinki) – Complaint Upheld (Finland, 2021)

Data subject has requested the Finnish Data Protection Ombudsman's opinion on the lawfulness of the processing of their personal data by the City of Helsinki's Social services and healthcare division. As a part of an application process to volunteer as a support person for children and youth, the data subject has given consent to the data controller to obtain the applicant's criminal record from the police, in accordance with national rules regarding criminal background investigation of volunteers working with minors. It was then discovered that the City of Helsinki has systematically processed extensive personal data of the applicants, not limited to criminal record but wide-ranging data from the data subject's police records, such as cases where data subject has been in claimant's role. Lawfulness of processing of personal data related to the investigation of criminal background of applicants seeking to volunteer as a support person for children and/or youth. The DPA held that the personal data processed exceeded what was necessary and relevant for the original purpose of the processing. Deputy Data Protection Ombudsman ordered the City of Helsinki, the data controller, to correct its data processing practice in accordance with the GDPR.