Tietosuojavaltuutetun toimisto (Finland) - 3075/182/2018

Tietosuojavaltuutetun toimisto (Finland) - 3075/182/2018
Authority:	Tietosuojavaltuutetun toimisto (Finland)
Jurisdiction:	Finland
Relevant Law:	Article 15(4) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:	03.01.2020
Fine:	None
Parties:	Anonymous OP Ryhmä
National Case Number/Name:	3075/182/2018
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Finnish
Original Source:	Finlex.fi (in FI)
Initial Contributor:	n/a

The Tietosuojavaltuutetun toimisto rejected a complaint filed by a data subject to gain access to his wife's bonus bank account details.

English Summary

Facts

The DPA received a complaint against the OP Financial Group (OP Ryhmä) from an applicant requesting comprehensive access to OP bonus account information in an account held by his wife.

Dispute

The Tietosuojavaltuutetun toimisto had to determine if the applicant was entitled to access such information from the couple's bonus account defined as a "family entity".

Holding

The Tietosuojavaltuutetun toimisto found that there was no such right to access or receive a copy of personal data from the wife's bank bonus account, as this would adversely affect her rights and freedoms under Art. 15(4) GDPR.

Comment

Share your comments articles here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Finnish original for more details.

FACTS
The applicant has stated that OP Financial Group has not fully exercised his right of access to OP bonus account information. Together, the applicant and his wife form a family entity whose main user is defined as the wife. The Applicant has been provided with information about his / her own OP Bonuses, but not the entire Bonus Account. The applicant further stated that he had been provided with information only since 1999, even though he had been a customer of OP Financial Group since 1972.

The Office of the Data Protection Ombudsman has requested clarification from OP Financial Group. The report stated that OP Helsinki had provided the applicant with all information to which the applicant had the right to access in accordance with both the Personal Data Act and the Privacy Regulation.

OP bonuses do not have an independent asset value, ie they cannot be converted into cash. OP bonuses only entitle you to a discount on OP products and services covered by the bonus rules. OP bonuses are automatically accrued on a monthly basis from banking, wealth management and insurance related to the private economy, provided that the customer has access to bonuses at OP Financial Group.

OP's bonus policy defines a "family entity" made up of individual customers eligible for OP bonus accruals. Pursuant to the Bonus Rules, OP bonuses accruing from dealing with individuals forming a family entity are, with their consent, recorded in the bonus account of only one family member. The person whose Bonus Account accrues family OP bonuses is the sole owner of the Bonus Account and any bonuses accruing to it. Other family members are eligible for the Family Entity Bonus Account. The statement stated that, due to bank secrecy and the lack of ownership, a member of a family entity bonus account is not entitled to receive information on bonuses accrued to the bonus account owned exclusively by another person or on the use of these bonuses. Therefore, the owner of the OP Bonus Account is solely controlled by the family to whom he or she wishes to disclose information about the OP Bonus Account or its events.

Information has been provided to the applicant since 1999, since his client relationship with OP Helsinki began on 11 October 1999. According to the statement, each OP Bank Group is an independent registrar in respect of customer information. If the applicant had a customer relationship with another bank and if that customer relationship had already ended, the customer relationship would no longer contain information on OP Financial Group's systems. The data is currently deleted 10 years after the end of the relationship (before 2018, the data will be deleted five years after the end of the relationship).

DECISION OF THE DATA PROTECTION SUPERVISOR
No right of access is given.

"Banking secrecy" means the right and obligation of both the bank and the bank's agents and trustees to keep confidential information obtained in the course of their business as a credit institution and relating to the personal or financial circumstances of individuals.

Pursuant to the secrecy obligation laid down in Chapter 15, Section 14 of the Credit Institutions Act (610/2014), a person's financial status or personal circumstances of a private person shall be kept secret unless the person in whose favor the obligation of professional secrecy is given expresses its consent.

It should be noted that the applicant's wife's accumulation of OP bonuses is a matter of financial standing within the meaning of the aforementioned law. The total amount of bonuses is also such a factor. By subtracting the total amount of bonuses earned by the applicant from his or her own business, it would be possible to deduce the total amount of bonuses accruing to the business of the applicant's wife, which should be considered as an element of the financial status of the applicant's wife.

According to Article 15 (4) of the General Data Protection Regulation, the right to obtain the copy referred to in Article 3 (3) must not adversely affect the rights and freedoms of others. In this case, the disclosure of the requested information would adversely affect the rights of the applicant's wife, such as the protection of her bank secrecy, which prevents the Assistant Data Protection Supervisor from issuing an order under Article 58 (2) (c) of the General Data Protection Regulation.

Finally, a request for access must be made to each controller individually.