Enforcement · Tietosuojavaltuutettu EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018

The DPA ordered a city to ensure that the personal data of pupils collected when using digital learning tools was only processed to fulfill the controller’s educational obligations.

Finland
Personal Data Processing Controllers Lawful Basis Supervisory Authorities Consent
Sep 28, 2026 Source gdprhub.eu

How it connects

Related across sources

CJEU: Processing of beneficiary data not based on consent; individuals must be informed Purpose for processing: The legislation at issue does base the processing on consent. Rather, it provides that they are to be informed. Thus, processing is not based on their… Nov 9, 2010 Consent Personal Data Right to Restriction
CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is Processing: Communication of personal data in response to a request for access to documents constitutes processing. (¶69) Jun 29, 2010 Personal Data Right to Restriction Processors
CJEU: Website operator embedding social plugin must obtain prior consent as controller Consent: It is the duty of the operator to obtain prior consent from the data subject. The consent given to the operator relates only to the operation or set of operations… Jul 29, 2019 Consent Personal Data Processing
CJEU Google Spain: data subject may require search engine to remove links to outdated Legitimate interest balancing test: Legitimate interest requires balancing of the interest of the controller and third party with the interest of the data subject. In this… May 13, 2014 Personal Data Consent Legitimate Interest
W137 2333649-1 Federal Administrative Court: retention of job applicant data for potential legal claims The data subject applied for a job with the association and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the… Jul 8, 2026 Right to be Forgotten Personal Data Consent
451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Supreme Administrative Court Jun 27, 2022 Consent Cookies Supervision

Full text

The DPA ordered a city to ensure that the personal data of pupils collected when using digital learning tools was only processed to fulfill the controller’s educational obligations. English Summary. Facts. In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked Article 6(1)(c) GDPR as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the Finnish Basic Education Act. The DPA issued a decision in case 1509/452/18 in December 2021. This decision was appealed to the Supreme Administrative Court, wh

Related documents