Content type · 35 documents in this view · 3,811 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Finland (35) Clear filter
Filter by Topic Supervisory Authorities 3587 Processing 2635 Personal Data 2394 Controllers 2017 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
Tietosuojavaltuutetun toimisto (Finland) - TSV/5059/2023 The DPA held that a pension insurance company had not violated Articles 5(1)(c) and 25(2) GDPR by disclosing a disability pension applicant's accrued pension in euros to a… TSV/5059/2023 ·
Finnish DPA orders Espoo to ensure pupil data protection in Google learning tools In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from… TSV/40/2018 ·Finland · Sep 4, 2026
Finnish DPA finds 12-year retention of rental applicant data violates minimisation The DPA began investigating the storage periods of the personal data of housing applicants (the data subjects) contained in rental housing applications during a previous… TSV/1319/2025 ·Finland · Aug 7, 2026
Finnish DPA examines anti-doping organization's GDPR compliance over public suspension An athlete (the data subject) gave a doping sample containing a low concentration of a banned substance in August 2020. The national anti-doping organisation (the controller)… TSV/179/2021 ·Finland · Aug 4, 2026
Finnish DPA: requesting address, ID number and strong authentication for access request A company that provides comparison services for loans and financial products (the controller) received a loan application submitted on the data subject’s behalf in October 2022.… TSV/4630/2023 ·Finland · Jul 22, 2026
€5,000 Suomen Numerokeskus Oy: Insufficient fulfilment of data subjects rights Deputy Data Protection Ombudsman fined Suomen Numerokeskus Oy €5,000 on 2026-03-02 for: Insufficient fulfilment of data subjects rights. Finland · ·Art. 15 Mar 2, 2026
€865,000 Aktia Pankki Oyj: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 865.000 euro boete - Waarnemend ombudsman gegevensbescherming. FINLAND · ·Art. 5, 25, 32 Oct 23, 2025
€865,000 Aktia Pankki Oyj: Insufficient technical and organisational measures to ensure information security The Finish DPA has imposed a fine of EUR 865,000 on Aktia Pankki Oyj. The controller changed its strong authentication process in such a way that it no longer guaranteed adequate… FINLAND · ·Art. 5, 25, 32 Oct 23, 2025
€1.8M S-Pankki Oyj: Insufficient technical and organisational measures to ensure information security The Finish DPA has imposed a fine of EUR 1,800,000 on S-Pankki Oyj. Due to a software error, customers of the controller were able to log in to the bank accounts of other… FINLAND · ·Art. 5, 25, 32 Sep 8, 2025
€1.8M S-Pankki Oyj: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 1.800.000 euro boete - Waarnemend ombudsman gegevensbescherming. FINLAND · ·Art. 5, 25, 32 Sep 8, 2025
€1.1M Universiteitsapotheek: Niet-naleving van algemene principes voor gegevensverwerking. 1.100.000 euro boete - Waarnemend ombudsman gegevensbescherming. FINLAND · ·Art. 5, 32 May 27, 2025
€1.1M Yliopiston Apteekin: Non-compliance with general data processing principles The Finish DPA has imposed a fine of EUR 1,100,000 on Yliopiston Apteekin. The controller, who runs an online pharmacy, used various web analytics and monitoring tools. These… FINLAND · ·Art. 5, 32 May 27, 2025
€950,000 Sambla Group Oy: Insufficient technical and organisational measures to ensure information security The Finnish DPA has imposed a fine of EUR 950,000 on Sambla Group Oy. Security vulnerabilities in two of its comparison portals allowed unauthorized persons to access personal… FINLAND · ·Art. 5, 25, 32 Dec 17, 2024
€2.4M Posti Jakelu Oy: Insufficient legal basis for data processing The Finnish DPA imposed a fine of EUR 2.4 million on Posti Jakelu Oy following an investigation. It was found that Posti had automatically set up an electronic mailbox for… FINLAND · ·Art. 6 Nov 13, 2024
€856,000 Verkkokauppa.com: Non-compliance with general data processing principles The Finnish DPA has imposed a fine of EUR 856,000 on Verkkokauppa.com Plc for not specifying the retention period of customer account data of e-commerce customers. The DPA also… FINLAND · ·Art. 5, 25 Mar 6, 2024
€23,000 Suomen Yritysrekisteri: Insufficient fulfilment of data subjects rights The Finnish DPA has fined Suomen Yritysrekisteri EUR 23,000. The controller had not sufficiently complied with data subjects' requests for access to their personal data. The… FINLAND · ·Art. 12, 15 Sep 11, 2023
€1,600 Company: Insufficient fulfilment of data subjects rights The Finnish DPA has imposed a fine of EUR 1,600 on a company providing psychotherapy services. A customer had submitted a request for access to their stored personal data.… FINLAND · ·Art. 12, 15 Sep 4, 2023
€440,000 Suomen Asiakastieto Oy: Insufficient cooperation with supervisory authority The Finnish DPA has imposed a fine of EUR 440,000 on Suomen Asiakastieto Oy for failing to comply with an order issued by the DPA. During an investigation, the DPA found that the… FINLAND · ·Art. 58 Feb 17, 2023
€122,000 Company: Insufficient legal basis for data processing The Finnish DPA has imposed a fine of EUR 122,000 on a company with products that process health data, such as heart rate, etc. The DPA had received several complaints regarding… FINLAND · ·Art. 9 Dec 27, 2022
€750,000 Alektum Oy: Insufficient fulfilment of data subjects rights The Finnish DPA has fined the debt collection company Alektum Oy EUR 750 000. The DPA opened an investigation against the controller after three people filed complaints against… FINLAND · ·Art. 12, 15 Dec 13, 2022
€230,000 Viking Line Oy Abp: Non-compliance with general data processing principles The Finnish DPA has imposed a fine of EUR 230,000 on Viking Line Oy Abp. A former employee had filed a complaint with the DPA. During its investigation, the DPA found that the… FINLAND · ·Art. 5, 12, 13 +2 Dec 9, 2022
€85,000 Otavamedia Oy: Insufficient fulfilment of data subjects rights The Finnish DPA has imposed a fine of EUR 85,000 on Otavamedia Oy. The DPA had received eleven complaints regarding Otavamedia between 2018 and 2021. Namely, the complaints… FINLAND · ·Art. 5, 12, 15 +2 May 9, 2022
€8,300 Telemarketing company: Insufficient cooperation with supervisory authority The Finnish DPA has imposed a fine of EUR 8,300 on a telemarketing company for non-compliance with a DPA order. A customer of the company had requested access to the recording of… FINLAND · ·Art. 58 Apr 29, 2022
€5,000 Medical clinic: Insufficient fulfilment of information obligations The Finnish DPA has fined a medical clinic EUR 5,000. A customer of the clinic had complained to the DPA that he had not received access to his medical records from the clinic… FINLAND · ·Art. 5, 12, 13 +2 Dec 26, 2021
€6,500 Travel agency: Insufficient technical and organisational measures to ensure information security The Finnish DPA has imposed a fine of EUR 6,500 on a travel agency. A customer of the travel agency informed the DPA to suspect that the company might not process the data of its… FINLAND · ·Art. 5, 17, 25 +1 Dec 16, 2021
€52,000 Motor insurance center: Non-compliance with general data processing principles The Finnish DPA has fined a motor insurance center EUR 52,000. The controller had excessively requested patient data from within the healthcare system for the purpose of… FINLAND · ·Art. 5, 25 Dec 16, 2021
€608,000 Psykoterapiakeskus Vastaamo: Non-compliance with general data processing principles The Finnish DPA has fined Vastaamo psychotherapy center EUR 608,000. In September 2020, the psychotherapy center reported an attack on its patient database to the DPA. An… FINLAND · ·Art. 5, 33, 34 Dec 7, 2021
€25,000 Higher Education Institution: Non-compliance with general data processing principles The Finnish DPA imposed a fine of EUR 25,000 on a higher education institution for data protection violations in the processing of employee location data. The controller had… FINLAND · ·Art. 5, 6 Jul 5, 2021
€8,500 Magazine publisher: Insufficient legal basis for data processing The Finnish DPA has imposed a fine of EUR 8,500 on a magazine publisher. The DPA received four complaints against the magazine publisher for unsolicited telephone advertising.The… FINLAND · ·Art. 5, 7, 12 +3 Jun 24, 2021
€75,000 ParkkiPate Oy: Insufficient fulfilment of data subjects rights The Finnish DPA has imposed a fine of EUR 75,000 on ParkkiPate Oy. A number of people had been issued parking tickets by the controller and had thereupon requested information… FINLAND · ·Art. 5, 12, 14 +3 Apr 21, 2021
€7,000 Acc Consulting Varsinais-Suomi: Insufficient legal basis for data processing Unsolicited marketing SMS without prior consent FINLAND · ·Art. 5, 6 Aug 5, 2020
€72,000 Taksi Helsinki: Non-compliance with general data processing principles Among other things, the company had not assessed the risks and consequences of processing personal data before introducing a camera surveillance system that records audio and… FINLAND · ·Art. 5, 6, 35 May 29, 2020
€12,500 Unknown Company: Insufficient legal basis for data processing Processing of employee data without sufficient legal basis. FINLAND · ·Art. 5, 6 May 22, 2020
€100,000 Posti Group Oyj: Insufficient fulfilment of data subjects rights The decision relates to complaints alleging that data subjects received direct marketing from the company although they had requested that their postal data be deleted.… FINLAND · ·Art. 12, 13, 14 +1 May 22, 2020
€16,000 Kymen Vesi Oy: Non-compliance with general data processing principles Fine for failure to carry out a data protection impact assessment ('DPIA') for the processing of location data of employees with a vehicle information system FINLAND · ·Art. 35 May 22, 2020