National Police Board of Finland – Complaint Upheld (Finland, 2024)

The Finnish DPA was notified that the National Police Board of Finland (the controller) had taken and processed unnecessary personal identifying characteristics of the data subject in the context of a criminal investigation and questioning. The DPA then asked the controller to explain the purpose of the processing of personal identifying characteristics. In response to the request, the controller clarified that the taking of personal identifying characteristics was based on [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L9P3 Chapter 9 Section 3 of the Finnish Coercive Measures Act], according to which the police may take fingerprints, handprints and footprints, handwriting, voice and olfactory samples, photographs and information on identifying marks regarding a person suspected in an offence, for the purposes of identification, clarification of an offence and registering of offenders. The controller stated that it had a legal basis for taking personal identifying characteristics in order to register the offender and that the registration did not violate the principle of proportionality because the data subject was suspected of having committed defamation, which is punishable under the Finnish Criminal Code. The controller argued that the relevance and necessity of taking personal identifying characteristics is not directly linked to the need to process them explicitly in the criminal case on the basis of which the person was registered. The controller argued that the need to process the identifying characteristics may arise in the context of the preliminary investigation of criminal cases that have already taken place or will take place in the future. According to the expert testimony provided by the data subject, the defamation offence could have been solved without taking personal identifying characteristics. The coercive measure violated the rights of the data subject, as the suspected offence could have been investigated and solved without the processing of personal identifying characteristics. The DPA noted that, according to the principle of proportionality under [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L1P2 Chapter 1 Section 2 of the Finnish Coercive Measures Act], coercive measures may only be used if they can be considered justified, taking into account the seriousness of the offence under investigation, the importance of clarifying the offence, the extent to which the use of coercive measures infringes the rights of the suspect in the offence or of others and the other circumstances of the case. On the basis of the information provided by the controller, the DPA considered that the taking of personal identifying characteristics for the sole purpose of registration did not meet the requirements of proportionality. The DPA therefore found that the nature of the suspected offence did not support the need for registration. The DPA also noted that under [https://www.finlex.fi/fi/laki/ajantasa/2018/20181054 the Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security]The Act implements Directive 2016/680 in Finland., the personal data processed must be adequate, necessary and not excessive in relation to the purposes for which they are processed. In addition, special categories of personal data may be processed only if it is strictly necessary, subject to appropriate safeguards for the rights of the data subject and only if the processing is based on a specific legal basis. The DPA stated that the necessity requirement for the processing of the data subject’s special categories of personal data is not met if personal data is collected solely for the purpose of registration without any other legal basis. Therefore, the registration of personal identifying characteristics was not necessary for the clarification of the suspected offence under investigation or for the identification of the data suspect. Furthermore, the DPA emphasised that the CJEU has held that [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016L0680 Directive 2016/680] must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to verify whether and demonstrate that, first, their collection is strictly necessary for achieving the specific objectives pursued and, second, those objectives cannot be achieved by measures constituting a less serious interference with the rights and freedoms of the person concerned.CJEU, Case C-205/21, Ministerstvo na vatreshnite raboti, 26 January 2023, margin number 135 (available here) In light of this, the DPA concluded that the provision in [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L9P3 Chapter 9 Section 3 of the Finnish Coercive Measures Act], which could be interpreted as allowing the registration of personal identifying characteristics only for the purpose of registration, was contrary to EU law. Therefore, the controller did not have a legal basis to register the personal identifying characteristics. On the basis of the information gathered, the DPA held that the controller violated several provisions of [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806 the Finnish Coercive Measures Act] and [https://www.finlex.fi/fi/laki/ajantasa/2018/20181054 the Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security]. As a result, and in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181054#L8P51 Chapter 8 Section 51(1)(9) of the Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security], the DPA ordered the controller to erase the personal identifying characteristics taken of the data subject.