Kesko Oyj – Violation Found (Finland, 2023)

The Finnish DPA had asked the controller (Kesko Oyj, Finland's largest retail chain) to explain how it processed and stored personal data in connection with its loyalty program. In response to the request, the controller clarified that it processed basic customer information, such as the person's name and contact information, and purchasing behaviour data. Purchasing behaviour data indicates customers' detailed and product-specific purchase data. Depending on the situation, the information related to the customer was erased at the end of the customer relationship or anonymised no later than 25 months after the end of the customer relationship. The controller also stated that it processes purchase data for business development, the provision of benefits and services, and the implementation and targeting of marketing. The controller emphasised that unjustifiably prohibiting or restricting the collection and processing of data that benefits the customer would undermine data-driven innovations and product development. The DPA stated that tying the storage period of purchase data to the duration of the customer relationship had resulted in the data being stored in a form that enables identification of the data subject for potentially very long periods, even decades. A storage period based on the duration of the customer relationship could therefore lead to very long storage of the purchase data, even for the lifetime of the data subject. Moreover, according to the DPA, some of the purchase data could be used to infer detailed information about the person's life situation, lifestyle and movements. Purchase data may also indirectly reveal personal data belonging to the special categories of personal data within the meaning of Article 9 GDPR. For example, customers had the opportunity to collect loyalty points by using certain healthcare services. The risk associated with the processing of such data increases the more extensive data is collected and the longer it is stored. Hence, the DPA considered that the controller should have defined the storage period for purchase data on a purpose-specific basis and assessed it separately from the storage period of other personal data needed to manage the customer relationship. The controller should have determined the storage period for purchase data already before engaging in any personal data processing activities since data subjects must be informed of the storage period when collecting personal data in accordance with Article 13(2)(a) GDPR. On the basis of the information gathered, the DPA held that the controller violated Article 5(1)(e) GDPR, Article 25(1) GDPR and Article 25(2) GDPR, as the storage period of purchase data tied to the duration of the customer relationship was not necessary for the purposes for which the controller processed the personal data. Furthermore, the DPA stressed that in compliance with data protection by default, the controller should have ensured that a data subject would have the opportunity to influence the level of collection of their personal data from the beginning, for example, by choosing in the registration form the level of data collection they want. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA also ordered the controller to define a storage period for purchase data according to the purpose of use and to erase or anonymise purchase data older than the defined storage period. In addition to the reprimand and the order, the Sanctions Board of the DPA assessed the necessity of imposing an administrative fine pursuant to Article 83 GDPR. The Board concluded that several factors would have justified the imposition of a fine. The infringement concerned 3.49 million data subjects, and the amount of data collected for each data subject had been significant. However, the Sanctions Board considered that tying the storage period of purchase data to the duration of the customer relationship had not yet led to such long storage periods to the extent that an administrative fine should be imposed.