Tietosuojavaltuutetun toimisto (Finland) - 9492/153/22

Tietosuojavaltuutetun toimisto - 9492/153/22
Authority:	Tietosuojavaltuutetun toimisto (Finland)
Jurisdiction:	Finland
Relevant Law:	Article 16 GDPR Article 17 GDPR Section 4 Subsection 4 of the Child Custody Act
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	14.11.2022
Published:	22.12.2022
Fine:	n/a
Parties:	n/a
National Case Number/Name:	9492/153/22
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Finnish
Original Source:	Finnish DPA (in FI)
Initial Contributor:	n/a

The Finnish DPA held that a parent who is not a legal guardian of the minor child, cannot request recficiation or deletion of personal data relating to the child.

English Summary

Facts

The parent of a minor child (the data subject), who was not their legal guardian, submitted a rectification and deletion request to the controller with regards to recorded information about the data subject which did not correspond to the factual situation. The parent attached a court form confirming the right to access information about the data subject. Although not clear from the decision itself, it seems that the controller refused to comply with the rectification and deletion request. Subsequently, the parent filed a complaint with the Finnish DPA.

During the course of the opened proceedings, the DPA contacted the controller but did not request more information from the parent.

Holding

The Finnish DPA recalled that Article 16 GDPR provides for the data subject's right to have incorrect data rectified while Article 17 GDPR grants the data subject the right to have incorrect data deleted.

With regards to personal data of minors, the DPA noted that Section 4 Subsection 4 of the Child Custody Act stipulates that the legal guardian represents the child in a matter concerning that person, unless the law provides otherwise. However, according to Chapter 2, Section 9, Subsection 1, Clause 3 of the Child Welfare Act, the court can decide that a parent who is not the legal guardian, has the same right to receive confidential information about the child from authorities and private service providers.

In this case, the DPA held that data subject rights under Articles 15-22 GDPR can only be exercised on behalf of the minor child by their legal guardian. The DPA noted that, although the parent had a court form confirming the right to access the data subject's personal data, this right did not extend to the right to request rectification or deletion of said personal data.

In conclusion, the DPA rejected the complaint by stating that the parent had no authority to make a rectification or deletion request on behalf of the data subject.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.

Exercising the registrant's rights on behalf of a minor child

Keywords: children's personal information
The right to delete data
Right to rectification of data

Legal basis: decision in accordance with the EU General Data Protection Regulation

Diary number: 9492/153/22

Decision of the Deputy Data Protection Commissioner

Thing

Request for correction and deletion of the child's medical data

Registrar

Hospital district

The applicant's requirements with justification

The applicant has demanded the correction and deletion of the information recorded in his minor child's information, because the recorded information has not corresponded to the real situation, according to the applicant.

Statement received from the applicant

The applicant has submitted documents and reports to the data protection commissioner's office, which show that he has a court-confirmed right of access to his minor child's information.

Clarifications

No clarifications have been requested from the parties involved in the case, because it has been considered to be obviously unnecessary in the manner referred to in section 34 subsection 2 section 5 of the Administrative Act (434/2003). Obtaining reports would not change the way the case is resolved. The matter can be resolved on the basis of the correction request brought to the notice of the data protection officer and the response of the data controller.

Applicable legal provisions

From 25 May 2018, the General Data Protection Regulation (EU) 2016/679 of the European Parliament and the Council (hereinafter: General Data Protection Regulation) has been applied. As a regulation, the legislation is immediately applicable law in the member states. The General Data Protection Regulation contains national leeway, on the basis of which national legislation can be used to supplement and specify matters specifically defined in the regulation. The general data protection regulation is specified by the national data protection act (1050/2018), which has been applied since January 1, 2019. The Personal Data Act (523/1999) was repealed by the Data Protection Act.

Article 16 of the General Data Protection Regulation provides for the data subject's right to have incorrect data corrected and Article 17 provides for the data subject's right to have incorrect data deleted.

The Child Custody and Visitation Rights Act (Child Custody Act, 1983/361) and Section 4, Subsection 4 of it stipulates that the guardian represents the child in a matter concerning that person, unless the law provides otherwise.

According to Chapter 2, Section 9, Subsection 1, Clause 3 of the Child Care Act, the court can decide that a parent who is not the child's guardian, or another person who has given their consent, has the same right as the guardian to receive confidential information about the child from authorities and private service providers either in all matters or in matters specified in the decision.

Section 14 of the Administrative Act (434/2003) provides for the speaking power of a disabled person. According to subsection 1, his guardian, guardian or other legal representative can speak on behalf of a disabled person. Section 3 provides separately for the right of a minor who has reached the age of 15 and his or her guardian or other legal representative to separately exercise the right to speak in a matter that concerns the minor's person or personal interest or right.

A legal issue

1. The Deputy Data Protection Commissioner must first decide whether the applicant is in a position in the case in question to be able to use the data subject's rights according to the General Data Protection Regulation on behalf of his or her minor child.

2. Only if the answer to the first question is affirmative, the deputy data protection commissioner can take a position on whether it should issue the order of Article 58, paragraph 2, subparagraph c of the General Data Protection Regulation to comply with the data subject's request for correction and deletion of data.

Decision and reasons of the Deputy Data Protection Commissioner

1. The applicant does not have the right to use the data subject's rights according to the General Data Protection Regulation.

According to the General Data Protection Regulation, there is a child in the case at hand. In the case of a minor, rights according to the General Data Protection Regulation can be requested by the guardian of the minor on behalf of the child or alongside him.

The right of a parent, who is not their child's guardian or other legal representative, to use the rights of the data subject is decided on the basis of valid legislation and a possible decision issued by a court in which a position has been taken on these rights. The Guardianship Act provides separately for the express right of access to information. The Administration Act provides for the right of a trustee, guardian or other legal representative to use the right to speak in matters concerning minors.

The documents show that the applicant has a court-confirmed right of access to the information of his minor child, whose guardian, trustee or other legal representative he is not. The Deputy Data Protection Commissioner states that it cannot, by its own decision, expand the content of the right to access to information stipulated in the law to include the fact that, based on the right to access to information, someone other than a guardian, guardian or legal representative could demand changes to be made to their minor child's information.

2. Since the applicant has not had the right to demand correction of information based on the General Data Protection Regulation, there are no conditions in the case to consider the necessity of issuing a possible order.

Appeal

According to Section 25 of the Data Protection Act (1050/2018), this decision can be appealed by appealing to the Administrative Court in accordance with the provisions of the Act on Trial in Administrative Matters (808/2019). The appeal is made to the administrative court.

Service

The decision is notified in accordance with § 60 of the Administrative Act (434/2003) by mail against receipt.