Jamk University of Applied Sciences – €25,000 Fine (Finland, 2021)

The Finnish DPA was notified that Jamk University of Applied Sciences (the controller) unnecessarily processed the location data of its employees. The DPA then asked the controller to explain the purpose for which it processed the location data of its employees. In response to the request, the controller clarified that it used a third-party mobile application that allowed remote employees to record their working hours. The controller explained that the use of the app also required location data to be enabled by default. The controller emphasised that it did not actively use the location data, but only processed it for system technical reasons. The controller also stated that the use of the app was voluntary. If the employee had chosen to use the app, the processing was based on the data subject's consent. The controller noted that the use of the app was also in compliance with [https://www.finlex.fi/fi/laki/ajantasa/2004/20040759#L2P3 Section 3 of the Finnish Act on the Protection of Privacy in Working Life], according to which the employer may only process personal data that is directly necessary for the employee's employment relationship. On the basis of the information provided by the controller, the DPA considered that the mere fact that the app does not allow the recording of working hours without processing location data did not make the processing necessary. The DPA noted that it was possible to record working hours without processing location data. The DPA also emphasised that according to [https://www.finlex.fi/fi/laki/ajantasa/2004/20040759#L2P3 Section 3 of the Finnish Act on the Protection of Privacy in Working Life], no exceptions to the necessity requirement can be made, even with the consent of the employee. The DPA found that consent does not override the necessity requirement under the Finnish Act on the Protection of Privacy in Working Life. Therefore, the data subject's consent cannot serve as a legal basis for collecting unnecessary personal data. Since there was no legal basis to process the employees' location data, the controller processed the personal data in violation of the principles of lawfulness and data minimisation. On the basis of the information gathered, the DPA held that the controller had violated Article 5(1)(a) GDPR, Article 5(1)(c) GDPR, Article 6 GDPR and [https://www.finlex.fi/fi/laki/ajantasa/2004/20040759#L2P3 Section 3 of the Finnish Act on the Protection of Privacy in Working Life]. As a result, and in accordance with Article 58(2)(f) GDPR, the DPA imposed a ban on processing on the controller, covering all processing related to location data that is or has been collected with the app. In addition to the ban on processing, the Sanctions Board of the DPA imposed an administrative fine of €25,000 on the controller in accordance with Article 83 GDPR. The fact that the main purpose of the controller's activities was not to make a profit, but to provide higher education in accordance with the law, was considered a mitigating factor that significantly reduced the amount of the fine.