Court case KHO:2023:56 – Court Ruling (Finland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Supreme Administrative Court of Finland ruled on a case involving a rental company that collected personal identity numbers of children living in rented housing. The court decided that the company did not need to collect this data, emphasizing the importance of only gathering necessary information. This decision highlights the need for businesses to follow data minimization principles under GDPR.
What happened
A Finnish rental company collected personal identity numbers of children without a necessary reason.
Who was affected
Children living in or applying for accommodation in rented housing were affected.
What the authority found
The Supreme Administrative Court found that collecting children's personal identity numbers was unnecessary, emphasizing data minimization under GDPR.
Why this matters
This case underscores the importance of data minimization, reminding companies to collect only necessary personal data. It highlights that having a legal basis for data processing is not enough if the data collected is not essential.
GDPR Articles Cited
National Law Articles
The rental company A Oy (the controller) regularly collected the personal identity numbers of minor children of families living in or applying for accommodation in rented accommodation. The Finnish DPA had ordered the controller to bring the processing operations regarding collection of the children's personal data into compliance with the GDPR, and to delete the collected personal identity numbers of minor children to the extent that there was no appropriate legal basis for their collection. In its decision, the DPA found that it was not necessary for the controller to, as a rule, collect the children’s personal data in light of the data minimisation principle stipulated in Article 5(1)(c) GDPR. The controller appealed the decision with the Administrative Court of Northern Finland which annulled the DPA’s decision. The Administrative Court viewed, inter alia, that the controller had a legitimate interest pursuant to Article 6(1)(f) GDPR for processing personal data of children for the purpose of its rental activities. Thereafter, the DPA challenged the court’s decision and appealed it with the Supreme Administrative Court in Finland. The DPA argued that the previous Court was incorrect to conclude that the processing in question was lawful because the controller had a legal basis under Article 6 GDPR. The DPA established that notwithstanding that the controller has a legal basis for processing, processing is still in breach of the GDPR when personal personal data are unnecessary for the specific purpose. In the view of the DPA, the court had failed to apply the principle of minimisation. The Supreme Administrative Court noted that the initial decision of the DPA did not address Article 6 GDPR. Therefore, the Supreme Administrative Court did not address the question of whether the controller had a legal basis within the meaning of Article 6 GDPR. The Supreme Administrative court focused on whether the controller’s collection of personal data of the children comp
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case KHO:2023:56 in FI
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case KHO:2023:56 - Finland (2023). Retrieved from cookiefines.eu
Last updated: