Otavamedia Oy: Insufficient fulfilment of data subjects rights

The Finnish DPA has imposed a fine of EUR 85,000 on Otavamedia Oy. The DPA had received eleven complaints regarding Otavamedia between 2018 and 2021. Namely, the complaints primarily concerned the lack of response to inquiries from data subjects. Otavamedia explained that some of the privacy requests had not been fulfilled due to a technical problem with email management. During the incident, messages received in the privacy inquiry email box were not forwarded to customer service representatives. The situation had only been discovered after seven months. In this context, the DPA noted that Otovamia should have tested the new e-mail system before using it in order to be able to guarantee the response to the requests and the rights of the data subjects. Analogous request were possible, but the request form had to be signed by the data subjects for identification purposes. However, Otavamedia was not processing the signature data in any other contexts, so the signature could not even be cross-checked.

The DPA concluded that Otavamedia thereby collected an unnecessarily large amount of data for identification purposes and made the exercise of data subject rights harder by requiring signatures. GDPR Articles: Art. 5 (1) c) GDPR, Art. 12 (1), (2), (3), (4), (6) GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 25 GDPR Industry: Media, Telecoms and Broadcasting