Supreme Court of Finland – Order (Finland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish Supreme Court asked for personal details like identity numbers when someone requested a criminal case copy, even though the law says they don't need to. The Finnish DPA looked into whether this was okay and found that GDPR doesn't apply when courts handle criminal records. This case shows that courts have special rules when dealing with personal data in criminal cases.
What happened
The Finnish Supreme Court asked for personal identity numbers and addresses when someone requested a criminal case copy for billing purposes.
Who was affected
Individuals requesting copies of criminal case documents from the Finnish Supreme Court.
What the authority found
The Finnish DPA concluded that GDPR does not apply to the processing of personal data by courts for criminal prosecution purposes.
Why this matters
This decision highlights that courts have different rules compared to other organizations when handling personal data, especially in criminal cases. It reminds businesses that GDPR may not cover all data processing activities, particularly those involving judicial functions.
GDPR Articles Cited
National Law Articles
A data subject requested a copy of a criminal case from the Finnish Supreme Court under [https://www.finlex.fi/fi/laki/ajantasa/1999/19990621 The Public Access to Information Act]. According to the Act, a person requesting the information does not have to indicate their identity, so the archives would not keep information about the case's recipient. However, the court asked the data subject for a personal identity number and home address for a billing purpose. It explained that it does not keep a separate register of persons who requested documents. Still, the information is required for the billing system maintained by the State Financial and Human Resources Service Center (Palkeet). Concerned that the defendant in the criminal case could later learn about persons receiving case materials and retaliate against them, the data subject asked the Finnish DPA to investigate it. The DPA assessed first whether it is competent to supervise the processing when courts disclose personal data contained in criminal records. Secondly, it examined the legality of collecting and processing personal identity numbers for billing purposes. Thirdly, it evaluated the Supreme Court's approach to providing information on those who requested and received a copy of a document. Concerning the first question, the DPA held that under Article 2(2)(d) GDPR, the Regulation does not apply to the processing of personal data by competent authorities, including courts, for criminal prosecution. Furthermore, according to the [https://curia.europa.eu/jcms/jcms/Jo1_6308/fr/ CJEU's] case C-245/20 - Autoriteit Persoonsgegevens, the procedure whereby a court temporarily makes available to journalists procedural documents containing personal data to enable them to understand better the course of the proceedings falls within the scope of that court's "judicial functions". Therefore, under Article 55(3) GDPR, the DPA is not competent to supervise such processing. Regarding the second question, the DPA held
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for Supreme Court of Finland in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Supreme Court of Finland - Finland (2022). Retrieved from cookiefines.eu
Last updated: