National Police Board of Finland – Complaint Upheld (Finland, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish DPA was notified that the National Police Board of Finland (the controller) had taken and processed unnecessary personal identifying characteristics of the data subject in the context of a criminal investigation and questioning. The DPA then asked the controller to explain the purpose of the processing of personal identifying characteristics. In response to the request, the controller clarified that the taking of personal identifying characteristics was based on [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L9P3 Chapter 9 Section 3 of the Finnish Coercive Measures Act], according to which the police may take fingerprints, handprints and footprints, handwriting, voice and olfactory samples, photographs and information on identifying marks regarding a person suspected in an offence, for the purposes of identification, clarification of an offence and registering of offenders. The controller stated that it had a legal basis for taking personal identifying characteristics in order to register the offender and that the registration did not violate the principle of proportionality because the data subject was suspected of having committed defamation, which is punishable under the Finnish Criminal Code. The controller argued that the relevance and necessity of taking personal identifying characteristics is not directly linked to the need to process them explicitly in the criminal case on the basis of which the person was registered. The controller argued that the need to process the identifying characteristics may arise in the context of the preliminary investigation of criminal cases that have already taken place or will take place in the future. According to the expert testimony provided by the data subject, the defamation offence could have been solved without taking personal identifying characteristics. The coercive measure violated the rights of the data subject, as the suspected offence could have been investigated and solved without the processing
National Law Articles
The Finnish DPA was notified that the National Police Board of Finland (the controller) had taken and processed unnecessary personal identifying characteristics of the data subject in the context of a criminal investigation and questioning. The DPA then asked the controller to explain the purpose of the processing of personal identifying characteristics. In response to the request, the controller clarified that the taking of personal identifying characteristics was based on [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L9P3 Chapter 9 Section 3 of the Finnish Coercive Measures Act], according to which the police may take fingerprints, handprints and footprints, handwriting, voice and olfactory samples, photographs and information on identifying marks regarding a person suspected in an offence, for the purposes of identification, clarification of an offence and registering of offenders. The controller stated that it had a legal basis for taking personal identifying characteristics in order to register the offender and that the registration did not violate the principle of proportionality because the data subject was suspected of having committed defamation, which is punishable under the Finnish Criminal Code. The controller argued that the relevance and necessity of taking personal identifying characteristics is not directly linked to the need to process them explicitly in the criminal case on the basis of which the person was registered. The controller argued that the need to process the identifying characteristics may arise in the context of the preliminary investigation of criminal cases that have already taken place or will take place in the future. According to the expert testimony provided by the data subject, the defamation offence could have been solved without taking personal identifying characteristics. The coercive measure violated the rights of the data subject, as the suspected offence could have been investigated and solved without the processing
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for National Police Board of Finland in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. National Police Board of Finland - Finland (2024). Retrieved from cookiefines.eu
Last updated: