Social and Health Services in Kymenlaakso (Kymsote) – Violation Found (Finland, 2022)

The DPA carried out an investigation into the controller’s processing on its own behalf, after receiving information from the police. The controller is the Kymenlaakso Joint Municipal Authority for Health and Social Services Kymsote. It assesses families that plan to be foster parents for their eligibility. During this procedure, the controller requires parents to file an access request to the police pursuant to Section 23 of the (Finnish) Criminal Data Protection Act, to see if there is a criminal record or status report on (one of) the parents. Such a report would contain valuable information for the controller’s assessment, for example whether someone has been arrested for drunk driving. Then, in the presence of the parents, the controller’s coaches would check the reports for any absolute obstacles to becoming a foster parent. The controller claimed that this information is absolutely necessary for the assessment. The DPA assessed whether the controller’s processing was in accordance with the GDPR. First, the DPA considered that the reports contain personal data relating to criminal convictions and offences, and therefore Article 10 GDPR applies. Moreover, it noted that the controller carries out a task in the public interest, and the controller can, in principle, rely on Article 6(1)(e) GDPR. However, the DPA also considered that pursuant to Article 6(2) GDPR, Finnish legislation contains a more detailed provision that regulates the processing of personal data pursuant to Article 10 GDPR, in Section 2(1)(3) of the Act (504/2002) on Criminal Background Check of Persons Working with Children. Moreover, it found that this legislation creates a proportionate and appropriate procedure for checking the criminal background of persons working with children. Second, the DPA considered that the purpose of a data subject's access request is not to provide a public authority with information that the data subject obtained from it. As stated, there was a proportionate and