Sanoma Media Finland Oy – Court Ruling (Finland, 2023)

The data subject had asked the Administrative Court of Hämeenlinna (the Court) to overturn [https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_9970/163/2019 the Finnish DPA's decision], according to which the media outlets owned by Sanoma Media Finland Oy (the controller) were not obliged to erase personal tax information because it was processed for journalistic purposes. The data subject filed the appeal claiming that the controller had processed their personal data unlawfully, and claimed that, unlike individual news that utilises public tax information, the tax information portals published by the controller do not contribute to the emergence of an important social debate. The data subject considered that the tax information portals contained information covered by the protection of people's privacy, which enabled the precise identification of individuals, and which had caused harm to the data subject and their family. The data subject also stated that if the Court considered that the tax information had been processed solely for journalistic purposes, the processing of personal data in the tax information portals had in any case violated Article 5(1)(a) GDPR and Article 32 GDPR, because the large-scale and permanent publication of personal data of a large number of people did not meet the requirements set for the security of processing. The controller emphasised that the tax information portals enable public debate on socially significant topics related to taxation, such as income disparity. The publication of tax information promotes opportunities to make observations related to society, especially when the information is available to everyone free of charge. The DPA pointed out that the question is not whether tax information can be published, but whether [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P27 Section 27(1) of the Finnish Data Protection Act] applies, according to which certain provisions of the GDPR do not appl