Court case KHO:2025:86 – Court Ruling (Finland, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Finnish court ruled that an insurance company could not request health data from applicants during the insurance application process. This decision is significant because it clarifies the rules around processing sensitive health information. Companies in the insurance sector should ensure they only collect necessary data at the right time.
What happened
An insurance company was found to have improperly requested health information from applicants.
Who was affected
Individuals applying for insurance who were asked for their health data.
What the authority found
The court held that the insurance company violated GDPR by requesting health data from applicants who were not yet considered insured persons.
Why this matters
This ruling sets a clear boundary on when sensitive health information can be collected, urging insurance companies to review their data collection practices.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The DPA started an ex-officio investigation into the practices of an insurance company regarding the processing of health data in connection with applications for voluntary personal insurance. During the insurance application process, the controller requested health information from healthcare providers concerning individuals applying for insurance, or individuals for whose death, illness, or injury insurance was being sought. The processing was based on Section 6(1)(1) of the Finnish Data Protection Act, which provides a national derogation from the prohibition on processing special categories of personal data for insurance activities. In a decision issued on 8 June 2022, the DPA found that this derogation did not apply at the application stage, as applicants could not be considered “insured persons” within the meaning of Section 6(1)(1). On that basis, the DPA concluded that the processing of health data violated Article 9 GDPR and ordered the controller to bring its processing operations into compliance and to cease requesting health data during the application phase. The insurance company appealed. The first instance Court upheld the DPA’s substantive assessment, reasoning that neither the wording of the Data Protection Act nor its preparatory materials supported extending the concept of “insured person” to applicants prior to the conclusion of an insurance contract. The controller then appealed this decision, arguing that the insurance derogation must also cover the application stage, given the structure and purpose of insurance law and the obligation of insured persons to disclose relevant health information before insurance is provided. The court upheld the appeal, overturning both the DPA and the first instance court’s decisions. The Court held that the concept of “insured person” in Section 6(1)(1) of the Data Protection Act must be interpreted in light of national insurance legislation, in particular the Insurance Contracts Act. Although the Data Protect
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case KHO:2025:86 in FI
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case KHO:2025:86 - Finland (2025). Retrieved from cookiefines.eu
Last updated: