Court case KHO:2025:51 – Court Ruling (Finland, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruling in Finland clarified that people can access information about who processed their personal data, but not the identities of the employees who did the processing. This decision is important because it helps individuals understand how their data is handled. It also sets a guideline for companies on what information they must provide when someone requests access to their data.
What happened
The Court of Justice ruled that individuals have the right to know when and why their personal data was accessed.
Who was affected
Individuals whose personal data was processed by a bank and who requested access to that information.
What the authority found
The Court held that people are entitled to know the times and purposes of data access but not the identities of the employees involved, unless necessary for exercising their rights.
Why this matters
This ruling emphasizes the importance of transparency in data processing. Companies should ensure they understand their obligations when responding to access requests from individuals.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A data subject made an access request to a bank (controller) regarding log data concerning him and in particular the identity of the employees who processed his customer data between 1 November and 31 December 2013, the purpose of the processing and the dates on which the data were accessed. The data subject filed a complaint with the DPA requesting access to this data. In August 2020, the DPA dismissed his complaint stating that no order for access to the data will be issued because the log data in question do not constitute data concerning the data subject but they relate specifically to the employees who have processed the customer data. The data subject appealed this decision to the court of first instance (Administrative Court of Eastern Finland). In September 2021, the court of first instance requested a preliminary ruling from the CJEU asking if the right of access of the data subject under Article 15(1) GDPR is to be interpreted so that it includes information collected by the controller which shows who, when and for what purpose he has processed the data subject's personal data, in particular when it concerns data relating to the controller's employees. In June 2023 the CJEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=274867&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 Case C-579/21]) held, inter alia, that Article 15(1) GDDPR must be interpreted as meaning that the information relating to the times and purposes of the searching of a person's personal data constitutes information that a data subject is entitled to obtain from the controller under that provision. By contrast, that provision does not establish such a right to information concerning the identity of the employees of the controller who have carried out the searches under the authority and on the instructions of the controller, except where that information is necessary to enable the data subject to exercise effectively the rights conferred on him by the GDPR and
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case KHO:2025:51 in FI
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case KHO:2025:51 - Finland (2025). Retrieved from cookiefines.eu
Last updated: