National Police Board of Finland – Complaint Upheld (Finland, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish data protection authority upheld a complaint against the National Police Board for taking unnecessary personal identifying characteristics during a criminal investigation. This ruling is important because it stresses that law enforcement must respect individuals' rights and only collect data that is necessary. The police were told that they could have investigated the case without this data.
What happened
The National Police Board of Finland collected unnecessary personal identifying characteristics from a person suspected of defamation.
Who was affected
A person suspected of defamation whose identifying characteristics were collected by the police.
What the authority found
The Finnish data protection authority found that the police violated the individual's rights by taking unnecessary personal identifying characteristics.
Why this matters
This case highlights the need for law enforcement to adhere to principles of necessity and proportionality when collecting personal data. It serves as a reminder for all organizations, including police, to respect individuals' rights.
National Law Articles
The Finnish DPA was notified that the National Police Board of Finland (the controller) had taken and processed unnecessary personal identifying characteristics of the data subject in the context of a criminal investigation and questioning. The DPA then asked the controller to explain the purpose of the processing of personal identifying characteristics. In response to the request, the controller clarified that the taking of personal identifying characteristics was based on [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L9P3 Chapter 9 Section 3 of the Finnish Coercive Measures Act], according to which the police may take fingerprints, handprints and footprints, handwriting, voice and olfactory samples, photographs and information on identifying marks regarding a person suspected in an offence, for the purposes of identification, clarification of an offence and registering of offenders. The controller stated that it had a legal basis for taking personal identifying characteristics in order to register the offender and that the registration did not violate the principle of proportionality because the data subject was suspected of having committed defamation, which is punishable under the Finnish Criminal Code. The controller argued that the relevance and necessity of taking personal identifying characteristics is not directly linked to the need to process them explicitly in the criminal case on the basis of which the person was registered. The controller argued that the need to process the identifying characteristics may arise in the context of the preliminary investigation of criminal cases that have already taken place or will take place in the future. According to the expert testimony provided by the data subject, the defamation offence could have been solved without taking personal identifying characteristics. The coercive measure violated the rights of the data subject, as the suspected offence could have been investigated and solved without the processing
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for National Police Board of Finland in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. National Police Board of Finland - Finland (2024). Retrieved from cookiefines.eu
Last updated: