Full text
9 paragraphsHeading: parties, composition and procedure
Data Protection Ombudsman August 7, 2026 Finlex Authorities Data Protection Ombudsman 2026 August 7, 2026 Data Protection Ombudsman Decisions by the Data Protection Ombudsman on the interpretation of the EU General Data Protection Regulation, the Act on the Protection of Privacy in Criminal Matters, and the Personal Data Act Table of Contents Click to expand the table of contents Limiting the Retention Period for Housing Applications Keywords retention period, limitation of retention, data minimization, privacy by design Case Year 2026 Date Issued August 7, 2026 Reference Number TSV/1319/2025 Legal Basis Decision pursuant to the EU General Data Protection Regulation Decision of the Deputy Data Protection Ombudsman Subject Retention periods for personal data contained in housing applications Data controller A company in the rental brokerage sector Initiation of the case Case TSV/225/2022 was initiated at the Office of the Data Protection Ombudsman on December 14, 2022, concerning a request to the data controller regarding the data subject’s right to erasure. Case TSV/225/2022 was resolved on February 28, 2025, by a decision of the Deputy Data Protection Ombudsman regarding the data subject’s right to erasure. However, during the investigation of the case, facts came to light regarding the data controller’s practices concerning the retention periods for personal data contained in housing applications, on the basis of which the Deputy Data Protection Ombudsman decided to continue investigating the matter as ansupervisory case initiated on her own initiative. This decision takes into account the findings in case TSV/225/2022 to the extent that the report provided information on the data controller’s general practices regarding the retention periods for personal data contained in housing applications. Report received from the data controller on February 26, 2024 In connection with case TSV/225/2022, a report was requested from the data controller on February 20, 2024. The data controller submitted a statement on the matter on February 26, 2024, in which the following was stated regarding retention periods and the collection of personal data: In its explanation, the data controller specified what information is collected from housing applicants during the application process. When applying for housing, the following personal data, among other things, is collected from housing applicants: basic information, personal identification number, information related to billing and collection, employer, nature of employment, student status, housing search criteria, financial information, and other information needed to assess the applicant’s ability to pay rent. The data controller has stated that a housing applicant may, on their own initiative, disclose a wide range of sensitive personal information about themselves to the real estate agency. In its report, the data controller has stated that it interprets the retention period specified in Section 10 of the Act on Real Estate Brokerage Firms and Rental Housing Brokerage Firms (1075/2000, hereinafter the “Real Estate Brokerage Act”) is the minimum requirement prescribed by law. The data controller has stated that it retains data from housing applications for 10 years, citing the 10-year statute of limitations on liability for damages. In addition, the data controller retains the data for two years toward the end of the statute of limitations period to handle any legal proceedings that may commence or have already commenced. Personal data collected in connection with rental housing applications is retained for a total of 12 years. The data controller has determined that it must retain personal data to avoid potential liability for damages. With regard to liability for damages, the data controller has stated that it is liable to pay damages to the real estate agent, among other things, in situations in which the data controller has failed to fulfill its obligation to verify the tenant’s ability to pay or the number of people moving into the apartment. The data controller has also stated that it must act impartially in the selection of residents. Statement by the Data Controller on August 15, 2025 The data controller submitted a statement on the matter on August 15, 2025. The data controller was asked on what grounds housing applications are retained for longer than the five-year retention period specified in Section 10 of the Real Estate Brokerage Act. In the statement, the data controller stated that information regarding housing applications is retained for the purpose of asserting or defending legal claims and to comply with the Anti-Money Laundering Act. With regard to compliance with the Anti-Money Laundering Act and the Accounting Act, the data controller has referred to those data subjects with whom payment transactions have taken place. The data controller has considered the retention period specified in Section 10 of the Real Estate Brokerage Act to be the minimum requirement for the retention period. The data controller has referred to Section 1.6, “Archiving,” of the Guidelines on Good Real Estate Brokerage Practices, which states that the retention periods are a minimum requirement. The guidelines state: “The retention period for the aforementioned information and documents is the minimum requirement prescribed by law. With regard to liability for damages, the brokerage firm should take into account the ten-year statute of limitations under the Limitation Act, which is why documents should be retained for ten years from the end of the assignment or from the time all actions related to the assignment agreement have been completed.” The data controller was asked how it had assessed the need for retention with respect to individuals with whom no lease agreement had been concluded. In its response, the data controller referred to the Deputy Data Protection Ombudsman’s decision TSV/225/2022, which determined that Section 10 of the Real Estate Brokerage Act requires a real estate brokerage firm to retain data concerning housing applications in accordance with the five-year retention period specified in that provision. According to the data controller, over the past 12 years there has been no instance in which a claim for damages would have progressed to a lawsuit filed in court after the five-year retention period (as provided in Section 10(3) of the Real Estate Brokerage Act); rather, all cases have either lapsed or been settled without litigation. The data controller has emphasized the need to retain the data to defend against unfounded claims for damages. The data controller has estimated that claims for damages are typically filed at a rate of a few to half a dozen per year. According to the data controller, it had received housing applications from approximately 82,000 people during the year preceding the investigation. According to the data controller, data collected more than five years ago is not used for any purpose other than to file or defend against legal claims, or to comply with anti-money laundering legislation. Statement by the Data Controller, December 22, 2025 The data controller submitted a supplementary statement on the matter on December 22, 2025. The data controller was asked to provide a statement regarding the nature and occurrence of claims for damages. According to the data controller’s statement, claims for damages are primarily related to problems arising in rental relationships, such as the loss of keys and the resulting costs. In the report, the data controller stated that, following the guidance provided in the request for clarification, the practices regarding retention periods have been amended for those data subjects with whom no lease agreement has been concluded. Statement by the Data Controller, May 31, 2026 The data controller submitted a supplementary statement on the matter on May 31, 2026. According to the data controller, it has amended its policies regarding the retention periods for personal data contained in housing applications, following the Data Protection Ombudsman’s request for clarification, with respect to those data subjects with whom an application for a rentalfor a rental apartment did not result in a lease agreement or other customer relationship. According to the data controller, a five-year retention period in accordance with Section 10(3) of the Real Estate Brokerage Act is observed for these data subjects. If a lease agreement has been concluded with the applicant, the retention period is 12 years, in accordance with the grounds set forth in the report issued on August 15, 2025. On June 4,2026, the data controller confirmed that the 12-year retention period is calculated from the date of termination of the brokerage assignment, in accordance with the commencement of the five-year retention period specified in Section 10(3) of the Real Estate Brokerage Act. Applicable Legislation Article 5 of the General Data Protection Regulation (GDPR) sets forth the principles governing the processing of personal data. According to Article 5(1)(c) of the General Data Protection Regulation, personal data must be adequate, relevant, and limited to is necessary in relation to the purposes for which they are processed (“data minimization”). According to Article 5(1)(e) of the General Data Protection Regulation, personal data must be kept in a form in which the data subject is identifiable only for as long as is necessary for the purposes of the processing; personal data may be stored for longer periods, if the personal data are processed solely for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with Article 89(1), provided that that appropriate technical and organizational measures required by this Regulation have been implemented to safeguard the rights and freedoms of the data subject (“storage limitation”). In accordance with Article 25(1) of the General Data Protection Regulation, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons posed by the processing, the controller must implement appropriate technical and organizational measures, both in defining the processing methods and, to implement appropriate technical and organizational measures, such as data pseudonymization, to effectively implement data protection principles, such as data minimization, so that the necessary safeguards are built into the processing and the processing complies with the requirements of this Regulation and the rights of data subjects are protected. According to Section 4 of the Act on the Statute of Limitations for Debts (728/2003, hereinafter referred to as the “Statute of Limitations Act”) Section 4 provides that a debt becomes time-barred three years after the date referred to in Sections 5–7, unless the statute of limitations has been interrupted prior to that. According to Section 7(1)–(2) of the Limitation Act, the limitation period for claims for damages or other compensation begins to run: 1) in the case of compensation based on a breach of contract, when the buyer has discovered a defect or deficiency in the subject matter of the sale, or when the other contracting party, as the creditor, has discovered a defect in the performance of the contract or should have discovered it; 2) in the case of damages based on an error or negligence committed by an agent, representative, or other person acting on behalf of another, from the time when the agent has submitted an account or, if the basis for the claim for damages is not apparent from the information in the account, when the principal has discovered the error or omission or should have discovered it; 3) in claims for damages not based on a contractual relationship, from the time the injured party became aware of, or should have become aware of, the damage and the party liable for it; and 4) in the restitution of an unjust enrichment, from the time the claimant became aware of, or should have become aware of, the payment made in error, the invalidity of a contract, or any other event serving as the basis for restitution, and the recipient of the unjust enrichment. However, the statute of limitations for damages or any other debt referred to in subsection 1 must be interrupted before ten years have elapsed from the breach of contract or from the event that caused the damage or forms the basis for restitution. This time limit does not, however, limit the injured party’s right to claim compensation for personal injury or environmental damage. Pursuant to Section 10(3) of the Brokerage Act, the commission log, the engagement agreements and their attachments, bid documents, prospectuses, and other documents related to the engagement must be retained for five years after the termination of the engagement. Pursuant to Article 58(2)(b) of the General Data ProtectionRegulation, Article 58(2)(b), the supervisory authority may issue a reprimand to the controller or processor if the processing activities have been in violation of the General Data Protection Regulation. Pursuant to Article 58(2)(c) of the General Data Protection Regulation, the supervisory authority may order the controller or processor to comply with the data subject’s requests regarding the exercise of the data subject’s rights under the General Data ProtectionRegulation. Pursuant to Article 58(2)(d) of the General Data Protection Regulation, a supervisory authority may order the controller or processor to bring their processing operations into compliance with the provisions of the General Data ProtectionRegulation, if necessary in a specific manner and within a specified time limit. Legal Issue The General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) applies in this case. As a regulation, it constitutes law directly applicable in the Member States. The General Data Protection Regulation is supplemented by the National Data Protection Act (1050/2018). The Deputy Data Protection Ombudsman must determine whether the retention period specified by the data controller for the personal data contained in housing applications complies with the—specifically the principle of data minimization under Article 5(1)(c), the principle of storage limitation under Article 5(1)(e), and the requirements for data protection by design under Article 25(1)—. If the controller’s procedure has not complied with data protection regulations, the Deputy Data Protection Commissioner must also assess whether the corrective powers provided for inRegulation. Decision and Rationale of the Deputy Data Protection Commissioner Decision The retention period specified by the data controller for rental housing applications does not comply with the principle of data minimization under Article 5(1)(c) of the General Data Protection Regulation, the principle of storage limitation under Article 5(1)(e), or the requirement of data protection by design under Article 25(1). The Deputy Data Protection Commissioner considers that the data controller cannot systematically retain all personal data contained in housing applications for 12 years. The Deputy Data Protection Commissioner considers that, as a general rule, the data controller must delete personal data retained pursuant to Section 10(3) of the Real Estate Brokerage Act at the end of the five-year retention period. If data is retained beyond five years for reasons related to claims for damages or for other justified reasons, the data controller must be able to demonstrate that there is a genuine need for such retention. The Deputy Data Protection Ombudsman issues a warning to the data controller pursuant to Article 58(2)(b) of the General Data Protection Regulation regarding the processing of personal data in violation ofregarding the processing of personal data in violation of Article 5(1)(c), Article 5(1)(e), and Article 25(1) of the General Data Protection Regulation. The Deputy Data Protection Commissioner shall issue an order to the controller pursuant to Article 58(2)(d) of the General Data Protection Regulation to bring the processing operations concerning data retention into compliance withRegulation in accordance with Article 5(1)(c) and (e) and Article 25(1), to the extent that these practices have not already been brought into compliance with the aforementioned provisions. The data controller must determine the retention periods for personal data contained in rental applications in accordance with the principles of data minimization and storage limitation. Justification General Provisions on the Determination of Retention Periods Article 5(1)(e) of the General Data Protection Regulation (GDPR) provides for the limitation of the retention of personal data. Personal data must be retained in a form that allows the data subject to be identified only for as long as is necessary to fulfill the purposes of the processing. The retention period for personal data must therefore be as short as possible. Personal data may not be retained “just in case” or to an extent that is excessive in relation to the purpose for which it is used. According to Recital 39 of the General Data Protection Regulation, personal data should be processed only if the purpose of the processing cannot reasonably be achieved by other means. Personal data should therefore not be retained for longer than is necessary. The retention period (or the criteria for determining it) may be influenced, for example, by legal requirements or industry-specific guidelines. If necessary, different retention periods must be established for different categories of personal data and/or processing purposes.
The data controller must set deadlines for the erasure of personal data or for periodically reviewing the necessity of retaining it, to ensure that personal data is not retained longer than necessary.
In Decision TSV/225/2022, the Deputy Data Protection Ombudsman stated that a data controller operating as a real estate brokerage firm is obligated to retain housing applications and their attachments in accordance with the five-year retention period specified in Section 10(3) of the Real Estate Brokerage Act. If personal data is retained for a period longer than the statutory retention period required by this provision, there must be lawful grounds for doing so. In the explanations provided in this matter, the data controller has cited, in determining the retention periods, the 10-year statute of limitations for claims for damages as well as potential legal proceedings that may commence toward the end of the limitation period, on the basis of which the housing applications it has received and the personal data associated with those applications are retained for a total of 12 years. With regard to claims for damages, the data controller has pointed out that, as a rental agency, it has, for example, an obligation to assess a tenant’s ability to pay, the obligation to ensure that the decision to rent is not influenced by discriminatory grounds, and the obligation to determine the number of people moving into a rental apartment. With regard to these obligations, the data controller states that it is liable for damages resulting from any negligence. In a report dated August 15, 2025, the data controller assessed that claims for damages generally relate to allegations of discrimination or disputes concerning the lease agreement. In a report submitted on December 22, 2025, the data controller described a typical claim for damages as relating, for example, to disputes concerning the handover or loss of keys. The data controller has stated that it operates in accordance with the guidelines generally used in the industry (Guidelines for Good Rental Brokerage Practices) regarding the 10-year retention period. Section 1.6 of the Guidelines for Good Rental Brokerage Practice states that “With regard to liability for damages, the brokerage firm should take into account the ten-year statute of limitations under the Limitation Act, which is why documents should be retained for ten years from the end of the assignment or from the time all actions related to the assignment agreement have been completed.” However, the data controller has retained the personal data contained in the housing applications for a period longer than that specified in the guidelines—a total of 12 years. The Deputy Data Protection Ombudsman emphasizes that it is the data controller’s responsibility to ensure the lawfulness of its operations even in situations where the data controller has relied on guidelines from an industry association when determining retention periods. The Deputy Data Protection Ombudsman notes, however, that guidelines from an industry association or other sources cannot be used to deviate from the mandatory provisions of the General Data Protection Regulation. 4 Retention of Personal Data Contained in Housing Applications Based on the 10-Year Statute of Limitations for Claims for Damages A debt arising from a claim for damages is subject to the general statute of limitations under Section 4 of the Limitation Act, according to which the debt becomes time-barred three years after the date referred to in Sections 5–7, unless the statute of limitations has been interrupted before that time. The starting point for the statute of limitations on claims for damages or other compensation is provided for in Section 7 of the Statute of Limitations Act. For example, pursuant to Section 7(1)(1) of the Statute of Limitations, the limitation period for damages or other compensation begins to run, in the case of compensation based on a breach of contract, the buyer has discovered a defect or deficiency in the subject matter of the sale, or when the other contracting party, as the creditor, has discovered a failure to perform the contract or should have discovered it. What is decisive is not always when the defect was actually discovered, but when the buyer or other party entitled to relief should have discovered it. 5 However, pursuant to Section 7(2) of the Statute of Limitations, the statute of limitations for claims for damages must be interrupted before ten years have elapsed from the breach of contract or from the event that gave rise to the damage or served as the basis for restitution. Personal injury and environmental damage are excluded from this absolute 10-year statute of limitations. In practice, the 10-year statute of limitations under the Limitation Act applies to situations where the damage may become apparent a significant time after the damaging event, and the injured party cannot reasonably be expected to have discovered the damage in such a way that the general three-year statute of limitations would begin to run as specified in Section 7(1). If the statute of limitations on a debt based on compensation for damages is not interrupted within three years of the discovery of the damage, or from the time when the damage should have been discovered (situations under Section 7(1) of the Statute of Limitations Act), the claim becomes time-barred after three years. The Deputy Data Protection Ombudsman acknowledges that retaining personal data contained in housing applications may, in some situations, be justified in case of potential legal claims. 6 The Deputy Data Protection Ombudsman also acknowledges that there may be some uncertainty or ambiguity regarding the starting point of the statute of limitations for a debt based on damages, particularly in situations where the damage may not become apparent until long after it has occurred. This challenge has also been acknowledged in the government’s bill on the statute of limitations. 7 The Deputy Data Protection Ombudsman notes, however, that the present case concerns personal data subject to a five-year retention period pursuant to Section 10(3) of the Real Estate Brokerage Act. Based on the reports submitted by the data controller, claims for damages have related, for example, to disputes arising from lease agreements, allegations of discrimination, or the loss of keys. In this context, the Deputy Data Protection Ombudsman draws attention to Decision 6652/154/19 of the Data Protection Ombudsman, in which it was held that retaining personal data related to job applications for more than two years after the conclusion of the last job application was not justified on the grounds of defending against allegations of discrimination. 8 It is also worth emphasizing that the present decision assesses the retention periods for personal data contained in housing applications, and not, for example, the retention periods for personal data contained in lease agreements or related documents. The Deputy Data Protection Ombudsman considers that the types of damages listed in the report submitted by the data controller appear to be of a nature that would likely come to light during the five-year retention period specified in the Real Estate Brokerage Act. The Deputy Data Protection Ombudsman also notes that, according to the controller’s estimate, claims for damages are filed in the range of a few to half a dozen each year, whereas the number of data subjects who submitted housing applications in the year preceding the investigation was estimated at 82,000. The Deputy Data Protection Ombudsman considers it disproportionate to retain all in this case, in practice, tens of thousands—housing applications for a longer period than provided for in Section 10(3) of the Real Estate Brokerage Act. The retention of housing applications cannot be considered systematically necessary for determining potential liability for damages beyond the five-year retention period, as it is likely that any damages would become apparent within this retention period. The Deputy Data Protection Ombudsman also draws attention to the fact that housing applications may contain data falling under the special categories of personal data, such as information regarding a tenant’s health, or otherwise sensitive information, such as the tenant’s receipt of social benefits or life circumstances. For the sake of clarity, the Deputy Data Protection Ombudsman emphasizes that if, in connection with a specific assignment or a person applying for housing, a claim—such as one for damages—is filed, or if there is a supervisory action by the Licensing and Supervisory Authority or another justified reason for retaining personal data, the data controller has the right to retain the information necessary for resolving that specific matter, which may also include information related to the housing application, for as long as necessary to resolve the matter in question. When assessing which personal data to retain and for how long, factors such as the nature and subject matter of any ongoing legal proceedings must be taken into account on a case-by-case basis. Appeals Pursuant to Section 25 of the Data Protection Act (1050/2018), an appeal may be filed against this decision with the administrativeCourt in accordance with the provisions of the Act on Proceedings in Administrative Matters (808/2019). Service of Notice The decision shall be served on the data controller by mail against a certificate of receipt, in accordance with Section 60 of the Administrative Procedure Act (434/2003). The decision shall be served on the Central Federation of Real Estate Agencies. Further Information on the Decision The decision was issued by Deputy Data Protection Ombudsman Heljä-Tuulia Pihamaa. The matter was presented by Senior Inspector Saana Sydänmaanlakka. The decision is not final. Footnotes: 1 Guidelines on transparency pursuant to Regulation 2016/679, WP260 rev.01 (issued on November 29, 2017, last revised and approved on April 11, 2018), pp. 38–39. 2 See, for example, Decision 1077/452/2017.
Reports by the data controller dated February 28, 2024, August 15, 2025, December 22, 2025, and May 31, 2026.
This decision is also being communicated to the Central Association of Real Estate Agents, which issued the guidelines, so that it may take the decision into account in its guidelines.
Government Bill 187/2002, p. 48.
See Decision 6652/154/19 of the Data Protection Ombudsman.
Government Bill 187/2002, particularly pp. 48–49.
See the Data Protection Ombudsman’s decision 6652/154/19. In that case, the data controller had set the retention period for personal data related to job applications at two years and six months, citing the need to defend against potential charges and lawsuits under the Criminal Code (RL, 39/1889) regarding employment discrimination (RL 47:3). The data controller continued to process the job applicants’ personal data for six months after the expiration of the two-year statute of limitations as a precautionary measure, so that it could also handle discrimination claims even if they were filed at the end of the statute of limitations. The Data Protection Ombudsman found that the data controller had no grounds to retain the data subject’s personal data beyond the two-year period.