Tietosuojavaltuutetun toimisto (Finland) - TSV/5059/2023

The DPA held that a pension insurance company had not violated Articles 5(1)(c) and 25(2) GDPR by disclosing a disability pension applicant's accrued pension in euros to a physician tasked with evaluating the applicant's ability to work. English Summary. Facts. A pension insurance company (the controller) had disclosure the amount of an applicant's (the data subject's) pension accrual in euros to a physician who conducted a medical evaluation of the data subject in March 2023. The purpose of the evaluation was to decide whether the data subject was entitled to disability pension. The DPA investigated whether the controller had violated the principle of data minimisation laid down in Article 5(1)(c) GDPR and the obligation to implement appropriate technical and organisational measures under Article 25(2) GDPR. The controller argued that the physician needed information on the data subject's accrued pension benefits to be able to assess the data subject's ab