The Finnish Motor Insurers' Centre – Court Ruling (Finland, 2023)

The Finnish Motor Insurers' Centre (the controller) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had been fined €52,000 for processing and requesting unnecessary patient information from healthcare providers. The controller filed the appeal claiming that it could not determine in advance whether certain information was necessary to settle a claim. The controller considered that under [https://www.finlex.fi/fi/laki/ajantasa/2016/20160460#L7P82 Section 82 of the Finnish Motor Liability Insurance Act], various information could be considered necessary, and therefore it had to process information other than that directly related to the traffic accident. The controller argued that it must evaluate both facts in favour of liability for damages and facts directly or indirectly against it, as well as other information necessary to assess the credibility of the evidence. In the controller's view, healthcare professionals would not ultimately be in a position to assess the legal question of what information is necessary to settle a claim. The Court noted that much of the injured party's health data may be necessary to assess the contribution of another injury to the occurrence of the relevant injury. Consequently, other health-related information necessary to settle a claim may sometimes be needed long before the traffic accident. In this respect, the Court considered that the information relating to healthcare appointments must, in principle, be considered as information necessary to establish the causation of the injury in order to settle a claim. Thus, the tasks related to the assessment of the claim belong to the core tasks of the insurance company and cannot be transferred, even partially, to the responsibility of the healthcare provider. The Court stated that the investigation carried out by the DPA could not be considered sufficient to prove that the controller had systematically collected and processed more information than it was entitled to do under [https://www.finlex.fi/fi/laki/ajantasa/2016/20160460#L7P82 Section 82 of the Finnish Motor Liability Insurance Act]. The Court also found that the DPA had not specified with sufficient precision what the unnecessary information could be. In light of this, the Court held that there was no reason to believe that the controller had systematically requested too extensive medical records or processed unnecessary patient information. The Court therefore concluded that the controller had not acted contrary to the principles of fairness or data minimisation, or to the requirements of data protection by design and default. As a result, the Court overturned the contested decision and removed the administrative fine imposed on the controller.