Court case KHO:2025:51 – Court Ruling (Finland, 2025)

A data subject made an access request to a bank (controller) regarding log data concerning him and in particular the identity of the employees who processed his customer data between 1 November and 31 December 2013, the purpose of the processing and the dates on which the data were accessed. The data subject filed a complaint with the DPA requesting access to this data. In August 2020, the DPA dismissed his complaint stating that no order for access to the data will be issued because the log data in question do not constitute data concerning the data subject but they relate specifically to the employees who have processed the customer data. The data subject appealed this decision to the court of first instance (Administrative Court of Eastern Finland). In September 2021, the court of first instance requested a preliminary ruling from the CJEU asking if the right of access of the data subject under Article 15(1) GDPR is to be interpreted so that it includes information collected by the controller which shows who, when and for what purpose he has processed the data subject's personal data, in particular when it concerns data relating to the controller's employees. In June 2023 the CJEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=274867&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 Case C-579/21]) held, inter alia, that Article 15(1) GDDPR must be interpreted as meaning that the information relating to the times and purposes of the searching of a person's personal data constitutes information that a data subject is entitled to obtain from the controller under that provision. By contrast, that provision does not establish such a right to information concerning the identity of the employees of the controller who have carried out the searches under the authority and on the instructions of the controller, except where that information is necessary to enable the data subject to exercise effectively the rights conferred on him by the GDPR and provided that the rights and freedoms of those employees are respected. The court of first instance concluded that the data subject is entitled to be informed of the time of processing of his data to the extent that they appear in the user logs but not of the identity of the bank employees who carried out the processing. The controller appealed this decision before the Supreme Administrative Court (Kor­kein Hal­lin­to-Oi­keus - KHO) claiming that the data subject is not entitled to be informed of the exact time of the processing of his personal data to the extent that they are indicated in the controller’s user logs, but it is sufficient to be informed of the dates of the processing, since this would not make any difference in his ability to exercise his rights under the GDPR. The court annulled the decision of the court of first instance in respect on the decision on the time of the day of the processing operations. The court highlighted that the purpose of Article 15(1) GDPR is to ensure transparency of the processing of the personal data, without which the data subject would not be able to assess the lawfulness of the processing of their data and to exercise their rights laid down in the GDPR. The precision with which a data subject is entitled to be informed of the timing of processing activities concerning his personal data must be assessed in the light of the aforementioned purpose. The court concludes that the data subject is only entitled to receive information regarding the dates on which his data had been accessed even if the time of the day is indicated in the log files. This information is sufficient to assess the lawfulness of the processing of his data and fully exercise his rights under the GDPR. Finally, the court referred the case back to the DPA to issue a decision in this regard.