View source for Tietosuojavaltuutetun toimisto (Finland) - TSV/428/2022

{{DPAdecisionBOX

|Jurisdiction=Finland
|DPA-BG-Color=
|DPAlogo=LogoFI.png
|DPA_Abbrevation=Tietosuojavaltuutetun toimisto
|DPA_With_Country=Tietosuojavaltuutetun toimisto (Finland)

|Case_Number_Name=TSV/428/2022
|ECLI=

|Original_Source_Name_1=Finlex
|Original_Source_Link_1=https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242343
|Original_Source_Language_1=Finnish
|Original_Source_Language__Code_1=FI
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Type=Complaint
|Outcome=Rejected
|Date_Started=28.10.2022
|Date_Decided=21.10.2024
|Date_Published=29.10.2024
|Year=2024
|Fine=
|Currency=

|GDPR_Article_1=Article 12(1) GDPR
|GDPR_Article_Link_1=Article 12 GDPR#1
|GDPR_Article_2=Article 15(3) GDPR
|GDPR_Article_Link_2=Article 15 GDPR#3
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_4=
|GDPR_Article_Link_4=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=fred
|
}}

The DPA held that an insurance company had not violated the requirements of [[Article 12 GDPR#1|Article 12(1) GDPR]] and [[Article 15 GDPR#3|Article 15(3) GDPR]] by first providing the data subject with a written transcript of the call recording, rather than the call recording itself.

== English Summary ==

=== Facts ===
The Finnish DPA was notified that an insurance company (the controller) had not provided the data subject with all the requested documents, emails, call recordings and other possible material related to the customer satisfaction survey. Instead, the controller had only provided a transcript, which, according to data subject, differed from the content of the call. The DPA then asked the controller to explain how it had implemented the data subject's request.

In response to the request, the controller clarified that it had provided the data subject with all the information requested by the data subject. The controller explained that, as the data subject had requested that the information be provided by post, the controller had provided the data subject with a transcript of the call, which reflected to the content of the call. The controller had then sent the call recording and other documents to the data subject by post on a flash drive.

The data subject had asked the DPA to decide whether the transcript corresponded with the call recording with sufficient accuracy and whether the controller should have provided a copy of the call recording by post immediately or only upon the data subject's new requests.

=== Holding ===
On the basis of the information provided by the controller, the DPA considered that the controller must assess, on a case-by-case basis, the appropriate format in which to provide the personal data requested under [[Article 15 GDPR]]. The DPA emphasised that personal data need not always be provided in the original format if the data can be properly provided in another form, such as, in writing.

The DPA noted that the information provided by the controller enabled the individual to verify the accuracy of the personal data. Therefore, the DPA considered that the controller had complied with the requirements of [[Article 12 GDPR#1|Article 12(1) GDPR]] and [[Article 15 GDPR#3|Article 15(3) GDPR]] by first providing a written transcript of the call recording.

With regard to the content of the call recording, the DPA found that the transcription of the call corresponded to the content of the call with the accuracy that the nature of the call recording allowed. The DPA found that the key factor in the case was that the data subject had also been provided with a copy of the call recording in electronic form, which had enabled the data subject to assess both the content of the transcription and the content of the call recording.

On the basis of the information gathered, the DPA concluded that the controller had provided the data subject with all the information requested and had therefore fully complied with the access request.

As a result, the DPA held that the controller had complied with the requirements of [[Article 12 GDPR#1|Article 12(1) GDPR]] and [[Article 15 GDPR#3|Article 15(3) GDPR]] by fulfilling the data subject's access request by first providing a written, transcribed version of the call recording.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.

<pre>
Thing
The registrant's right to access information

Registrar
Insurance company

The requirements of the registrant with reasons
On 28 October 2022, the registrant has requested all documents, e-mails, call recordings and possible other material related to the customer satisfaction survey from the controller by mail. The registered person has contacted the data protection commissioner's office on 29 November 2022. According to the registered person, he had received an answer to his inspection request, but the transcription contained in the answer did not correspond to the content of the call. The data subject has demanded the data protection commissioner's office to order the data controller to deliver the requested call recording and other requested material free of charge.

Statement received from the registrant
According to the registered contact, he has received a call related to the customer satisfaction survey on 28 October 2022. According to the registrant, he has submitted a request for the right of inspection to the controller regarding the call recording and other material related to the customer satisfaction survey. According to the contact sent on November 29, 2022, he had not received the call recording or other documents he requested, only the transcription, which, in his view, differed from the content of the call.

Statement received from the registrar
According to the report submitted by the controller on August 13, 2024, the data subject has been provided with all the information requested in the inspection request. Regarding the call recording, the controller has first stated to the data subject that the call recording saved in electronic form cannot be delivered by post, and instead delivered a transcription to the data subject. After this, the call recording and other documents requested by the data subject have been delivered to the data subject by mail with a memory stick. According to the registrar, a phone recording has been delivered to the data subject, a customer list has been delivered to the entity that carried out the survey, email correspondence on the matter and a letter has been delivered to the data subject. According to the registrar's report, this information was sent on 15 December 2022. According to the registrar's understanding, the transcription of the call recording corresponds to the content of the call. The registry keeper's report states that there is an unclear point in the call recording, the sentence of which can be understood in two different ways, either "I just that" or "I can answer that".

The data controller has submitted the information provided to the data subject as an attachment to the report, including a copy of the call recording.

The registered equivalent
The registrant has been asked for a response in the case on 14 August 2024. The registrant has submitted a response on 19 August 2024. The registrant has presented in his reply that there are inconsistencies between the recording and the transcribed text. In its response, the registered party has demanded the deputy data protection commissioner to take a position on whether the transcription corresponds to the call recording with sufficient accuracy. The registrant has stated in his response that he has received a copy of the call recording by post on a memory stick only after repeating the request. The registrant has demanded the deputy data protection commissioner to take a position on whether a copy of the call recording should have been delivered by mail immediately or only after the new requirements.

On applicable legislation
The General Data Protection Regulation (EU) 2016/679 of the European Parliament and the Council (General Data Protection Regulation) and the specifying national data protection act (1050/2018) apply in this case.

According to Article 12(1) of the General Data Protection Regulation, the data controller must take appropriate measures to provide the data subject with the information in accordance with Articles 13 and 14 and all processing information in accordance with Articles 15-22 and 34 in a concise, transparent, easily understandable and accessible form in clear and simple language especially when the information is specifically intended for a child. The information must be submitted in writing or in another way and, as the case may be, in electronic form. If the data subject requests it, the information can be given verbally, provided that the identity of the data subject has been confirmed in another way.

According to Article 15 of the General Data Protection Regulation, the data subject has the right to receive confirmation from the controller that personal data concerning him or her is being processed or that it is not being processed, and if it is processed, the right to access the personal data and the information in accordance with Article 15, paragraph 1, subparagraphs a–h. According to paragraph 3 of the article, the controller must provide a copy of the personal data being processed. If the data subject requests several copies, the controller may charge a reasonable fee based on administrative costs. If the data subject submits the request electronically, the information must be submitted in a commonly used electronic format, unless the data subject requests otherwise.

According to Article 58, paragraph 2, subparagraph b of the General Data Protection Regulation, the data protection commissioner's office can issue a notice to the controller or personal data processor if the processing operations have been in violation of the data protection regulation.

According to Article 58, paragraph 2, subsection c of the General Data Protection Regulation, the data protection commissioner's office can order the data controller or personal data processor to comply with the data subject's requests regarding the use of the data subject's rights based on the data protection regulation.

A legal question
The Deputy Data Protection Commissioner assesses and resolves the matter on the basis of the aforementioned General Data Protection Regulation (EU) 2016/679 and the Data Protection Act (1050/2018).

It has to be evaluated

1. has the data controller complied with the requirements of Article 12(1) and Article 15(3) of the General Data Protection Regulation when responding to the data subject's request to access the data by first providing a written, transcribed version of the call recording;
2. whether the controller must be given a notice in accordance with Article 58, paragraph 2, subparagraph b of the General Data Protection Regulation;
3. whether the data controller has exercised the registrant's right in accordance with Article 15 of the General Data Protection Regulation to access information about himself; and
4. whether the controller must be given an order in accordance with Article 58, paragraph 2, subparagraph c of the General Data Protection Regulation to comply with the data subject's request.

Decision and reasons of the Deputy Data Protection Commissioner
Decision of the Deputy Data Protection Commissioner
The Deputy Data Protection Commissioner considers that the data controller has complied with the requirements of Article 12(1) and Article 15(3) of the General Data Protection Regulation when responding to the data subject's request to access the information by first providing a written, transcribed version of the call recording. The deputy data protection commissioner does not issue a notice to the controller.

The Deputy Data Protection Commissioner considers that the data controller has fulfilled the data subject's request to access the data. The Deputy Data Protection Commissioner does not give an order to the data controller to deliver information about the data subject.

Reasons for the decision
The requirements of Article 12(1) and Article 15(3) of the General Data Protection Regulation and delivery of the call recording as transcribed
According to Article 15, paragraph 3 of the General Data Protection Regulation, the controller must provide a copy of the personal data being processed. According to Article 12, Paragraph 1 of the General Data Protection Regulation, the data controller must take appropriate measures to provide the data subject with all processing information in accordance with Article 15 in a concise, transparent, easily understandable and accessible format in clear and simple language. The information must be submitted in writing or in another way and, as the case may be, in electronic form.

In decision 3592/152/19 (issued on 21 October 2021), the data protection commissioner has considered that it is the duty of the data controller to assess the appropriate form in which the information according to Article 15 is delivered in each case. The Data Protection Commissioner has considered that the data controller does not always have the obligation to provide information in the original form, if the information can also be properly provided in another way, for example in writing. However, the data controller must make sure that the form in which the data is delivered is such that the data subject can verify the correctness of the personal data processed by the data controller. However, the possibility to deliver the data in a form other than the original does not mean that the data controller can modify the personal data it provides in such a way that the data delivered to the data subject does not correspond to the data that the data controller processes.

The controller has delivered the call recording and its transcription to the data protection commissioner's office. The duration of the call recording in question is 28 seconds. The call recording contains a part where the interviewer and the data subject speak partially at the same time. Due to the quality of the recording and the indistinctness of the speech, the transcription may contain inaccuracies. Due to the ambiguity of the call recording, it is, for example, unclear whether the registered person says "there", "to that" or "there" or "I just that" or "But, but that". However, the unclear parts of the recording are related to individual wording choices, which cannot be considered to have an impact on the intelligibility or correctness of the transcription. The deputy data protection commissioner states that the transcription of the call recording corresponds to the content of the call in essential parts. The transcript's description of the call corresponds to the content of the call with the accuracy that is possible due to the nature of the recording. However, the key thing is that the data subject is also provided with a copy of the call recording in electronic form. The registered person has therefore had the opportunity to evaluate the contents of both the transcription and the recording.

According to the registrant, he first received the call transcribed, and after repeating the request, the call recording was delivered by post on a memory stick. Based on the report provided by the data controller, the data controller has first provided a transcription of the call, because the data subject has requested information by mail and the call recording is stored in electronic format. After renewing the request, the data controller has delivered the call recording on a memory stick by post. The registered person has thus received both a copy of the call recording and a transcribed call recording. With the help of the information received, the registered person can verify the correctness of the personal data processed by the controller and check the personal data concerning him.

The Deputy Data Protection Commissioner states that it is the responsibility of the data controller to assess the appropriate form in each case in which the information according to Article 15 of the General Data Protection Regulation is submitted. It is not always an obligation to provide this information in the original form, if the information can also be appropriately provided in another way, for example in writing. In this case, transcription would have been a possible way to implement the data subject's right to access the data. However, in addition to transcription, the controller has provided the data subject with a copy of the call recording in electronic form at the data subject's request. The deputy data protection commissioner considers that the data controller has complied with the requirements of Article 12, paragraph 1 and Article 15, paragraph 3 of the General Data Protection Regulation when first submitting a written, transcribed version of the call recording. Since the Deputy Data Protection Commissioner considers that the data controller has acted in accordance with Article 12, Paragraph 1 and Article 15, Paragraph 3 of the General Data Protection Regulation when responding to the data subject's inspection request, the Deputy Data Protection Commissioner does not issue a notice to the data controller.

Implementation of the request according to Article 15 of the registered General Data Protection Regulation
Based on the report provided by the data controller, the data subject has been provided with all the information requested by the data subject. In its reply, the registered does not deny that it has received the information provided by the controller. The deputy data protection commissioner considers that the data subject's inspection right has been fully implemented. Since the data controller has implemented the data subject's inspection request, the deputy data protection commissioner does not give the data controller an order to deliver information about the data subject.
</pre>