Verkkokauppa.com Oyj – €856,000 Fine (Finland, 2024)

The Finnish DPA was notified that the controller (Verkkokauppa.com Oyj, an IT retailer) required customers to create a customer account in order to make online purchases, even for one-time purchases. The DPA then asked the controller to explain why it required the creation of a customer account, for what purposes and for how long it stored the personal data of its customers. Regarding the purpose of the creation of a customer account, the controller clarified that the processing of customers' personal data was necessary for the provision of services and for the performance of the contract with the customer. The controller argued that it was able to reliably identify the data subject, demonstrate its accountability and facilitate the exercise of data subject rights through the customer account. The controller explained that it sells long-lasting devices that may have very long warranty and defect liability periods. Therefore, it was in the customers' interest to have access to information and receipts regarding their online purchases through the customer account throughout the customer relationship. The controller emphasised that if it allowed its customers to make online purchases without a customer account, it would have to process and store the personal data required for the placing and delivery of the order on an order-by-order basis, which would not be appropriate from a data security perspective and would not be in line with the principle of data minimisation. Regarding the data retention periods, the controller stated that the contractual relationship was for an indefinite period, the duration of which was determined by the customer. Thus, the controller stored personal data until the customer account was deleted at the request of the data subject. The controller claimed that it was not in a position to assess on behalf of the customer how long the customer relationship should last. On the basis of the information provided by the controller, the DPA considered that the processing of personal data related to a single online purchase did not require the creation of a customer account, as it resulted in personal data being stored for longer than necessary. Therefore, the processing of personal data for the creation and maintenance of a customer account could not be considered necessary for the performance of an online purchase contract. The DPA noted that the provisions on warranty and liability for defects are defined in the [https://www.finlex.fi/fi/laki/ajantasa/1978/19780038 Finnish Consumer Protection Act], according to which there is a defect in the product for which the seller is responsible if the product lasts for a shorter period of time than reasonably expected. Thus, the duration of liability for defects is determined on a case-by-case basis based on the expected lifespan of the product. The DPA stated that the consumer's right to seek remedies for the lack of conformity does not depend on whether the consumer has provided their personal data to the seller. Accordingly, the seller's obligation to remedy the lack of conformity is not affected by whether the seller has access to the consumer's personal data. The DPA found that the controller had intentionally left the storage period of the personal data it processed for customer accounts completely undetermined, leaving the limitation of the storage period to the responsibility of the customer. As a result, the erasure of the personal data had to be requested by the data subject in accordance with Article 17 GDPR. The DPA emphasised that the controller may not transfer the responsibility for the protection of personal data to the data subject. The storage of personal data cannot be justified by the fact that the data subject may later exercise their rights, such as requesting the erasure of their data. On the basis of the information gathered, the DPA held that the controller had violated Article 5(1)(e) GDPR and Article 25(2) GDPR. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA also ordered the controller to define a reasonable storage period for its customer data and to stop requiring its customers to create a customer account in order to make online purchases. In addition to the reprimand and the order, the Sanctions Board of the DPA imposed an administrative fine of €856,000 on the controller under Article 83 GDPR, for failing to determine the storage period for its customer data. The Board considered that the controller's practice was intentional, long-lasting and affected a large number of data subjects.