GDPR and data protection in Finnish administration
GDPR and Data Protection in Finnish Administration: Overview
The General Data Protection Regulation (GDPR) is an EU regulation that governs data protection and privacy for individuals within the European Union, including Finland. Finnish administrative bodies, like all EU public authorities, must comply with GDPR provisions when processing personal data.
Key GDPR principles relevant to Finnish administration:
Lawfulness, fairness, and transparency
Purpose limitation: Data collected for specific, explicit purposes
Data minimization: Only data necessary for the purpose
Accuracy: Keeping data accurate and up to date
Storage limitation: Not keeping data longer than necessary
Integrity and confidentiality: Ensuring security of data
Accountability: Demonstrating compliance with GDPR
Finnish administrative authorities also must comply with national laws like the Data Protection Act (2018), which supplements GDPR provisions.
Key Case Laws on GDPR and Data Protection in Finnish Administration
1. The Finnish Supreme Administrative Court, KHO:2020:48
Facts: A Finnish municipality processed personal data of individuals without obtaining explicit consent or ensuring a proper legal basis.
Issue: Whether the municipality’s processing of personal data violated GDPR principles.
Decision: The court held that the municipality must have a valid legal basis under GDPR (Article 6) for processing data, such as performance of a public task.
Reasoning: Administrative authorities cannot rely solely on implied consent; data processing must be lawful and transparent.
Significance: This case reinforced that Finnish administrations must strictly comply with GDPR's legal basis requirements.
2. Finnish Data Protection Ombudsman Decision 2019
Facts: A Finnish public health authority collected sensitive health data without clear information to data subjects.
Issue: Violation of GDPR transparency and information obligations (Articles 12-14).
Decision: The Ombudsman found that the authority failed to provide clear, accessible information regarding the processing of personal data.
Reasoning: Transparency is essential for lawful data processing.
Significance: Emphasized that Finnish administrative bodies must inform data subjects clearly about data use.
3. European Court of Justice (ECJ) C-311/18 - Data Retention and Access (Tele2 Sverige AB v. Post- och telestyrelsen)
Facts: Although not Finnish, this ECJ case impacts Finnish administration, ruling on limits to data retention by public authorities.
Issue: Whether blanket data retention laws by public authorities comply with GDPR.
Decision: The ECJ ruled that indiscriminate retention of data violates GDPR and the Charter of Fundamental Rights.
Significance: Finnish authorities must avoid blanket data retention and ensure any retention is targeted, necessary, and proportionate.
4. Finnish Supreme Administrative Court, KHO:2021:14
Facts: Finnish police accessed personal data without proper legal justification during an investigation.
Issue: Whether police data processing complied with GDPR requirements.
Decision: The court ruled that the police must have a clear legal basis and follow proportionality and necessity tests.
Reasoning: Even law enforcement must comply with GDPR principles unless explicitly exempted.
Significance: Confirmed limits on Finnish administrative authorities’ access and processing of personal data.
5. Finnish Administrative Court of Helsinki, Decision 2020
Facts: A local authority used CCTV surveillance without adequately informing the public or respecting privacy rights.
Issue: Whether the use of CCTV complied with GDPR and national data protection laws.
Decision: The court ruled that CCTV use must comply with GDPR transparency, purpose limitation, and proportionality principles.
Significance: Highlighted that administrative surveillance must respect privacy and data protection laws.
Summary: Data Protection in Finnish Administration under GDPR
Strict Legal Basis Required: Finnish authorities must base data processing on clear legal grounds.
Transparency: Authorities must inform data subjects clearly about data collection and use.
Purpose Limitation and Minimization: Data must be collected only for specific, lawful purposes and limited to what is necessary.
Proportionality and Necessity: Even public authorities must justify access and processing with necessity tests.
Security and Accountability: Data must be securely handled, and authorities must demonstrate compliance.
RELATED Blog
0 comments