City of Helsinki – Violation Found (Finland, 2023)

The Finnish DPA was notified that through the search function of an online service operated by the City of Helsinki (the controller), it was possible to see the names of all persons registered with the service. The DPA then asked the controller to explain how it had implemented appropriate technical and organisational measures to ensure the security of the processing. In response to the request, the controller clarified that the service in question was a participatory budgeting platform where city residents could discuss the development of the city and suggest things they would like to see in their own residential area. Following the DPA's request, the controller had discovered a data breach in relation to the platform. The controller stated that the user profiles of all 124,000 people registered on the platform had been publicly searchable and viewable by default through the platform's own search function. The profiles had also been viewable through Google Search and had displayed at least the first and last name of the users. The controller also noted that all profiles had been deleted and the possibility to register on the service had been closed. In addition, the controller had disabled the search function of the service and requested Google to remove the search results from Google Search. On the basis of the information provided by the controller, the DPA considered that, given the nature of the service, it could not be considered necessary that the user profiles had been publicly searchable and visible to all through the platform's own search function. The DPA found that the controller had not implemented any technical or organisational measures to prevent third parties from accessing data to which they should not have access. On the basis of the information gathered, the DPA held that the controller violated Article 25(2) GDPR and Article 32(1) GDPR by making the user profiles and related personal data to be searchable and viewable by anyone. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR.