Police University College – Complaint Upheld (Finland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish DPA ruled that the Police University College must provide a student with a copy of their exam video, despite the video showing other students. The college initially refused, citing privacy concerns for others in the video. This decision highlights the importance of balancing privacy rights with access to personal data.
What happened
The Police University College refused to give a student a copy of their exam video, claiming it showed other students and couldn't be edited.
Who was affected
The student who requested a copy of their exam video from the Police University College.
What the authority found
The Finnish DPA decided that the college must provide the video, as simply giving written test results doesn't fulfill the student's right to access their data.
Why this matters
This case emphasizes that organizations must find ways to provide access to personal data, even when it involves others, by using techniques like video anonymization. It serves as a reminder for institutions to carefully consider how they handle requests for personal data.
GDPR Articles Cited
The data subject requested a video recording of their screening test from the Finnish Police University College (controller). However, the controller refused to provide a copy because the video showed other students participating in the exam. Furthermore, according to the controller, it was technologically not possible to make a copy of the video recording that would only show the data subject. So instead, the controller provided the data subject with a written explanation of the test results and invited them to view the video recording at the controller's facilities. The controller justified its decision by Article 15(4) GDPR, according to which the right to obtain a copy shall not adversely affect the rights and freedoms of others. The controller also considered that Article 15(3) GDPR gives it a margin of discretion as to the form in which it can provide access to personal information. After the data subject complained, the Finnish DPA evaluated whether the granting of video recording would adversely affect the rights and freedoms of other persons appearing in the recording within the meaning of Article 15(4) GDPR. The DPA held first that giving a piece of written information about the screening test results does not release the controller from its obligation to provide a copy of the video recording. Further, the controller cannot use the protection of third parties as a mere excuse to prevent the data subject from having legal access to their data. Instead, the controller must sufficiently demonstrate that providing a copy of the video recording would, in fact, adversely affect others. Finally, if such a risk exists, the controller must balance conflicting interests considering the individual case circumstances and the risks' likelihood and severity. In particular, the controller should consider applying technical measures such as video anonymisation to preserve the privacy of other persons. Consequently, the DPA ordered the controller to provide the data subj
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Police University College in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Police University College - Finland (2022). Retrieved from cookiefines.eu
Last updated: