Supreme Court of Finland – Order (Finland, 2022)

A data subject requested a copy of a criminal case from the Finnish Supreme Court under [https://www.finlex.fi/fi/laki/ajantasa/1999/19990621 The Public Access to Information Act]. According to the Act, a person requesting the information does not have to indicate their identity, so the archives would not keep information about the case's recipient. However, the court asked the data subject for a personal identity number and home address for a billing purpose. It explained that it does not keep a separate register of persons who requested documents. Still, the information is required for the billing system maintained by the State Financial and Human Resources Service Center (Palkeet). Concerned that the defendant in the criminal case could later learn about persons receiving case materials and retaliate against them, the data subject asked the Finnish DPA to investigate it. The DPA assessed first whether it is competent to supervise the processing when courts disclose personal data contained in criminal records. Secondly, it examined the legality of collecting and processing personal identity numbers for billing purposes. Thirdly, it evaluated the Supreme Court's approach to providing information on those who requested and received a copy of a document. Concerning the first question, the DPA held that under Article 2(2)(d) GDPR, the Regulation does not apply to the processing of personal data by competent authorities, including courts, for criminal prosecution. Furthermore, according to the [https://curia.europa.eu/jcms/jcms/Jo1_6308/fr/ CJEU's] case C-245/20 - Autoriteit Persoonsgegevens, the procedure whereby a court temporarily makes available to journalists procedural documents containing personal data to enable them to understand better the course of the proceedings falls within the scope of that court's "judicial functions". Therefore, under Article 55(3) GDPR, the DPA is not competent to supervise such processing. Regarding the second question, the DPA held that courts charge a fee under [https://www.finlex.fi/fi/laki/ajantasa/1999/19990621#L8P34 § 34 of the Public Access to Information Act] for providing access to documents. Further, the payment in the present case is charged ex post facto, and according to [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P29 § 29(2) of the Finnish Data Protection Act], a personal identity number may be processed for debt collection. Consequently, the processing is justified under Article 6(1)(c) GDPR as it is necessary for compliance with a legal obligation to which the controller is subject. Finally, the DPA also requested the Supreme Court to reassess the likelihood and severity of the risk of discovering the data subject's identity by accessing information from the billing system where it is stored. The Supreme Court must announce the reassessment and possible measures to reduce or eliminate the risks by 15 September 2022.