Enforcement · Tietosuojavaltuutettu ·TSV/12992/2025 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Tietosuojavaltuutetun toimisto (Finland) - TSV/12992/2025

The DPA held that a social media platform had violated Article 12(4) GDPR by failing to inform the data subject of the reasons for not taking action on their request to object to direct marketing.

Status Not cited by any decision here yet

Finland
Marketing Direct Marketing Controllers Social Media Personal Data
GDPRhub page Oct 12, 2026 Source gdprhub.eu

Full text

Machine translation of the decision, via GDPRhub — not the official text.

The DPA held that a social media platform had violated Article 12(4) GDPR by failing to inform the data subject of the reasons for not taking action on their request to object to direct marketing. English Summary. Facts. A user of a social media platform (the data subject) sent the platform (the controller) an email where they objected to the processing of their personal data for direct marketing purposes. The controller replied with instructions on how to delete data stored in the social media app and opt out of targeted marketing in the app's internal settings. Following three further emails where the data subject repeated this request, the data subject lodged a complaint against the controller in October 2025. According to the data subject, the controller had violated Articles 12 and 21 GDPR by referring the request to a customer service representative instead of the data protection officer and providing irrelevant and misleading information. The controller stated that its cust

How it connects

Related across sources

C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Child Consent
C-17/22 HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG and Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG v Müller Rechtsanwaltsgesellschaft mbH and Others The Court of Justice of the European Union (Fourth Chamber) issued a preliminary ruling in joined cases C-17/22 and C-18/22, originating from the Amtsgericht München, concerning… Fourth Chamber Sep 12, 2024 Legitimate Interest Personal Data Fairness & Transparency
C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens The CJEU ruled on a preliminary reference from the Amsterdam District Court in proceedings between the Koninklijke Nederlandse Lawn Tennisbond (KNLTB) and the Dutch Data… Ninth Chamber Oct 4, 2024 Personal Data Legitimate Interest IP Address
C-154/21 RW v Österreichische Post AG The Court of Justice of the European Union (First Chamber), in response to a preliminary reference from the Oberster Gerichtshof (Austrian Supreme Court), interpreted Article… First Chamber Jan 12, 2023 Personal Data Right of Access Right to Restriction
C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Het Hof van Justitie van de EU (Eerste Kamer) beantwoordt een prejudiciële vraag over de uitleg van artikel 13 van Richtlijn 2002/58/EC (ePrivacy) en de verhouding tot de GDPR,… Mar 27, 2025 Telecommunications Personal Data Marketing
C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) Jun 5, 2018 Controllers IP Address Personal Data
Related documents