Enforcement · Deputy Data Protection Ombudsman EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Motor insurance center: Non-compliance with general data processing principles

The Finnish DPA has fined a motor insurance center EUR 52,000.

€52,000 Fine
Motor insurance center
FINLAND
Art. 5 GDPR Art. 25 GDPR
Retention Period Controllers Insurance Transparency Processing
Dec 16, 2021 Source tietosuoja.fi

Full text

The Finnish DPA has fined a motor insurance center EUR 52,000. The controller had excessively requested patient data from within the healthcare system for the purpose of processing claims. However, much of the data was not necessary to process the claims. For example, the DPA found that the motor vehicle insurance center had also collected patient visit notes to determine whether the health care provider had billed for visits that were not related to the examination or treatment of injuries caused by the accident. The DPA notes that the Finnish Motor Insurance Act does not justify direct access to all patient data, but that the information requested must be necessary for the processing of the claim. For this reason, the authority recognized a violation of the principles of legality and transparency as well as data minimization in practice.

Industry: Finance, Insurance and Consulting

How it connects

References

Related across sources

C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" Jan 7, 2026 Personal Data Fairness & Transparency Controllers
C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) Jan 12, 2023 Supervisory Authorities IP Address Supervision
HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). Jan 9, 2025 IP Address Retention Period Identification
C-17/22 HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG and Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG v Müller Rechtsanwaltsgesellschaft mbH and Others The Court of Justice of the European Union (Fourth Chamber) issued a preliminary ruling in joined cases C-17/22 and C-18/22, originating from the Amtsgericht München, concerning… Fourth Chamber Sep 12, 2024 Legitimate Interest Personal Data Fairness & Transparency
C-638/23 Amt der Tiroler Landesregierung v Datenschutzbehörde In Case C-638/23, the Court of Justice interpreted Article 4(7) GDPR in response to a preliminary reference from the Austrian Verwaltungsgerichtshof in proceedings between the Amt… Eighth Chamber Feb 27, 2025 Public Authority Controllers Personal Data
C-306/21 Komisia za zashtita na lichnite danni and Tsentralna izbiratelna komisia v Koalitsia „Demokratichna Bulgaria - Obedinenie“ In this preliminary ruling, the Court of Justice of the European Union addressed whether the GDPR applies to the processing of personal data during national and European elections… Eighth Chamber Oct 20, 2022 Material scope (GDPR) Supervision Personal Data
Related documents