Bisnode Finland Oy – Complaint Upheld (Finland, 2021)

Controller is Bisnode Finland Oy, a company that keeps a credit information register. This register gives an overview of the creditworthiness of debtors, whose debts are shown in the register. Bisnode Finland Oy receives information from the Legal Register Centre regarding court cases in which a debtor challenges a payment obligation. Because the Courts and the Legal Register Centre made errors between 2011 and 2017, this information, turned out to be inaccurate and transferred without a legal basis, because it did not fulfil the obligations of Article 6(1) of the (Finnish) Credit Information Act. Since the controller relied on the information provided by the Legal Register Centre, they also registered inaccurate personal data without a legal basis. A data subject who was registered in controller's credit register because of three cases, requested the DPA to order controller to delete their personal data from the controller’s credit information register, because it was processed without a legal basis and the controller did not provide clear criteria on which they determined the debtor's creditworthiness. The controller, however, argued that they carefully assessed each outcome of court cases to determine the creditworthiness of the debtor, that they had a legal basis to process this information (Article 6(1) Credit Information Act), and that they could not establish fixed criteria of this assessment, since this is “to some extend a matter of human reasoning and consideration” and must therefore be done on a case-by-case basis. First, the DPA noted that, although the issues occurred between 2011 and 2017, the issues had continued since the GDPR entered into force, and therefore, the GDPR applied to this case. Second, the DPA stated that that in each of the three instances, the entries should not have been registered, because these conditions laid down in Article 6(1) Credit Information Act, had not been fulfilled. Hence, the DPA concluded that there was no legal basis to process the personal data, the processed’ personal data was inaccurate, and these entries should have been deleted after the data subject requested the controller to do so. Third, the DPA considered that the entry of payment information in the credit information register concerns large-scale processing, and has wide-ranging implications for the rights and freedoms of the data subject, since their financial freedom might be severely affected. The DPA found that controller’s structural process of assessing court decisions on a case-by-case basis, without fixed criteria, had led to the processing of personal data without a legal basis. Hence, the controller had lacked to implement appropriate measures to implement the data protection principles, like the principle laid down in Article 5(1)(a) GDPR. The DPA, therefore, concluded that the controller's approach to the processing of payment default data based on final judgments did not comply with Article 25(1) GDPR. Pursuant to Article 58(2)(b) and Article 58(2)(d) GDPR, the DPA reprimanded the controller for its violations, and ordered the controller to bring their processing operations in compliance with the GDPR. Hence, the controller was ordered to remove all incorrect entries and change its procedure for registering default entries based on final judgements. The DPA noted that an administrative fine pursuant to Article 83 GDPR would not have been proportionate, since the incorrect entries of the Legal Register Centre had a significant impact on this case.