Court case KHO:2023:56 – Court Ruling (Finland, 2023)

The rental company A Oy (the controller) regularly collected the personal identity numbers of minor children of families living in or applying for accommodation in rented accommodation. The Finnish DPA had ordered the controller to bring the processing operations regarding collection of the children's personal data into compliance with the GDPR, and to delete the collected personal identity numbers of minor children to the extent that there was no appropriate legal basis for their collection. In its decision, the DPA found that it was not necessary for the controller to, as a rule, collect the children’s personal data in light of the data minimisation principle stipulated in Article 5(1)(c) GDPR. The controller appealed the decision with the Administrative Court of Northern Finland which annulled the DPA’s decision. The Administrative Court viewed, inter alia, that the controller had a legitimate interest pursuant to Article 6(1)(f) GDPR for processing personal data of children for the purpose of its rental activities. Thereafter, the DPA challenged the court’s decision and appealed it with the Supreme Administrative Court in Finland. The DPA argued that the previous Court was incorrect to conclude that the processing in question was lawful because the controller had a legal basis under Article 6 GDPR. The DPA established that notwithstanding that the controller has a legal basis for processing, processing is still in breach of the GDPR when personal personal data are unnecessary for the specific purpose. In the view of the DPA, the court had failed to apply the principle of minimisation. The Supreme Administrative Court noted that the initial decision of the DPA did not address Article 6 GDPR. Therefore, the Supreme Administrative Court did not address the question of whether the controller had a legal basis within the meaning of Article 6 GDPR. The Supreme Administrative court focused on whether the controller’s collection of personal data of the children comp