Tietosuojavaltuutetun toimisto (Finland) - 6465/182/2018

Tietosuojavaltuutetun toimisto (Finland) -
Authority:	Tietosuojavaltuutetun toimisto (Finland)
Jurisdiction:	Finland
Relevant Law:	Article 5(1)(c) GDPR Article 6(1)(a) GDPR Article 13 GDPR Article 21(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	None
Parties:	Finnkino Anonymous
National Case Number/Name:
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Finnish
Original Source:	Tietosuoja.fi (in FI)
Initial Contributor:	n/a

The Tietosuojavaltuutetun toimisto ordered Finnkino to change its privacy policy and to change its practices to guarantee the right to object in accordance with the GDPR.

English Summary

Facts

The DPA received 40 complaints against the cinema company Finnkino regarding its direct marketing communications, the information about the collection of data and the data subject's rights.

Dispute

In addition to the issue regarding the lack of information about the collection of data and the data subject's rights, the Tietosuojavaltuutetun toimisto had to determine if a controller pursue direct marketing communications without the data subjects' consent?

Holding

The Tietosuojavaltuutetun toimisto found that Finnkino was pursuing direct marketing communications without having obtained customers’ valid consent. Moreover, it didn’t inform the data subjects that their calls are recorded and that they have the right to object to data processing. Finally, it collected more data than necessary for its purposes. Thus, Finnkino was ordered to change its privacy policy according to the GDPR requirements. The decisions on all complaints are not final since they are subject to appeal before the Administrative Court.

Comment

Share your comments articles here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Finnis original for more details.

Assistant Data Protection Officer gave Finnkino a note and order to change the way personal data are processed
12.12.2019 9.04
Release

The Assistant Data Protection Commissioner has ordered Finnkino Oy to change its privacy policy. Incorrect practices include, but are not limited to, enforcing customer privacy rights and sending direct email marketing. The Office of the Data Protection Ombudsman has dealt with 40 Finnmark cases.

The Assistant Data Protection Officer gave Finnkin a note on the forced consent to electronic direct marketing. If a customer wanted to buy Finnkino e-tickets or book tickets online, they had to join the Finnkino Lab customer program and agree to receive direct marketing. The client program could not be joined without ticking the box that indicated its consent to direct marketing. This policy does not meet the requirements of the General Data Protection Regulation on voluntary consent as a basis for processing personal data.

In his decision, the Assistant Data Protection Officer also noted that Finnkino has not exercised the data subject's right to object to the processing of personal data. Under data protection law, a data subject may at any time object to the processing of their personal data for direct marketing purposes. The Assistant Data Protection Supervisor states that the data subject must be able to object to the processing of personal data even when his or her personal data are collected. Therefore, it is not sufficient for the customer to subsequently request the company to stop sending electronic direct mail.

In addition, the Assistant Data Protection Officer gave Finnkino a note on the procedures for identifying the data subject, which have caused unreasonable inconvenience to customers. Finnkino has required customers to send a photo of their passport or both sides of their identity card for identification. In addition, a photo of the person's face next to the ID is required for identification. Finnkino has demanded more information for identification than it originally had.

The Assistant Data Protection Officer's note also applies to the fact that Finnkino had not told its customers about the recording of calls. However, even before the note from the Assistant Data Protection Officer, Finnkino has changed this approach.

As the legal situation has been unclear since the date of application of the General Data Protection Regulation, the Assistant Data Protection Supervisor considers that Finnkino's reprehensible conduct does not require a heavier penalty than the comment. The decision is also influenced by the fact that, based on the feedback received, Finnkino has spontaneously taken action to comply with the General Data Protection Regulation.

Of the cases now closed, 34 concerned forced consent for direct electronic marketing and six concerned data subject identification practices. In addition, in one case it was complained that Finnkino had not told the customer about the recording of the calls.

The decisions are subject to appeal to the Administrative Court, so they are not yet final.

Decision of the Assistant Data Protection Supervisor on consent for direct marketing purposes and the exercise of the right of objection (Finlex)
Assistant Data Protection Officer's decision to identify the data subject and record calls (Finlex)

For more information:
Assistant Data Protection Officer Anu Talus, tel. +358 29 566 6766, anu.talus (at) om.fi