Sanoma Media Finland Oy – Court Ruling (Finland, 2023)

The data subject had asked the Administrative Court of Hämeenlinna (the Court) to overturn [https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_9970/163/2019 the Finnish DPA's decision], according to which the media outlets owned by Sanoma Media Finland Oy (the controller) were not obliged to erase personal tax information because it was processed for journalistic purposes. The data subject filed the appeal claiming that the controller had processed their personal data unlawfully, and claimed that, unlike individual news that utilises public tax information, the tax information portals published by the controller do not contribute to the emergence of an important social debate. The data subject considered that the tax information portals contained information covered by the protection of people's privacy, which enabled the precise identification of individuals, and which had caused harm to the data subject and their family. The data subject also stated that if the Court considered that the tax information had been processed solely for journalistic purposes, the processing of personal data in the tax information portals had in any case violated Article 5(1)(a) GDPR and Article 32 GDPR, because the large-scale and permanent publication of personal data of a large number of people did not meet the requirements set for the security of processing. The controller emphasised that the tax information portals enable public debate on socially significant topics related to taxation, such as income disparity. The publication of tax information promotes opportunities to make observations related to society, especially when the information is available to everyone free of charge. The DPA pointed out that the question is not whether tax information can be published, but whether [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P27 Section 27(1) of the Finnish Data Protection Act] applies, according to which certain provisions of the GDPR do not apply to the processing of personal data solely for journalistic purposes. The Court noted that the purpose of publishing tax information could reasonably be considered to be disclosure of information to the public. In the tax information portals published by the controller, public tax information concerning the data subject has been processed solely for journalistic purposes in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P27 Section 27(1) of the Finnish Data Protection Act]. In this respect, the Court considered that information published on the tax information portals consisted of accurate public tax information and did not reveal sensitive details of the data subject's private life. Therefore, the exemptions provided for in [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P27 Section 27(1) of the Finnish Data Protection Act] could be deemed necessary to reconcile the right to the protection of personal data with the freedom of expression and information in accordance with Article 85(2) GDPR. The Court held that the provisions on the security of processing in Article 32 GDPR are not intended to limit the publication of information resulting from the purpose of the processing of personal data, and they may not be interpreted together with Article 5(1)(a) GDPR as restrictions on such processing. In light of this, the Court agreed with the DPA that the controller had not violated the GDPR or the Finnish Data Protection Act.