Tietosuojavaltuutetun toimisto (Finland) - 6689/186/20
From GDPRhub
| Tietosuojavaltuutetun toimisto - 6689/186/20 | |
|---|---|
 | |
| Authority: | Tietosuojavaltuutetun toimisto (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 5(1) GDPR Article 6 GDPR Article 10 GDPR Article 12 GDPR Article 25 GDPR 812/2000 Laki sosiaalihuollon asiakkaan asemasta ja oikeuksista 148/2014 Laki lasten kanssa toimivien vapaaehtoisten rikostaustan selvittämisestä |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 15.01.2021 |
| Published: | 02.02.2021 |
| Fine: | None |
| Parties: | Helsingin kaupunki (City of Helsinki) |
| National Case Number/Name: | 6689/186/20 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Finnish |
| Original Source: | Finlex (in FI) |
| Initial Contributor: | V |
The Finnish DPA ordered the data processor, the City of Helsinki, to align its data processing practice related to the criminal background check of applicants seeking to volunteer as a support person for children and young persons.
English Summary
Facts
Data subject has requested the Finnish Data Protection Ombudsman's opinion on the lawfulness of the processing of their personal data by the City of Helsinki's Social services and healthcare division. As a part of an application process to volunteer as a support person for children and youth, the data subject has given consent to the data controller to obtain the applicant's criminal record from the police, in accordance with national rules regarding criminal background investigation of volunteers working with minors. It was then discovered that the City of Helsinki has systematically processed extensive personal data of the applicants, not limited to criminal record but wide-ranging data from the data subject's police records, such as cases where data subject has been in claimant's role.
Dispute
Lawfulness of processing of personal data related to the investigation of criminal background of applicants seeking to volunteer as a support person for children and/or youth.
Holding
The DPA held that the personal data processed exceeded what was necessary and relevant for the original purpose of the processing. Deputy Data Protection Ombudsman ordered the City of Helsinki, the data controller, to correct its data processing practice in accordance with the GDPR.
Comment
This decision does not assess the activities of the police in relation to the processing of personal data, in particular the transfer of data. In accordance with the inspection plan of the Office of the Data Protection Ombudsman (10253/164/20), the disclosure of personal data to the authorities in individual cases will be subject to inspection in 2021. The decision will therefore be sent to the Police Board and the Helsinki Police Department for information. The decision will be sent to the Ministry of Social Affairs and Health for information for a possible assessment of the timeliness of the legislation, as the decision concerns the interpretation of Section 20 of the Act on the Rights and Status of Social Welfare Clients. The decision will also be sent to the Finnish Non-Discrimination Ombudsman for information upon request. The decision is not yet final.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
Processing of personal data related to the investigation of criminal background in connection with the activities of child support staff Keywords: Criminal background Personal data Data minimization Support personnel activities Legal basis: Decision under the EU General Data Protection Regulation Diary number: 6689/186/20 THING The data subject has sent a request for action to the Office of the Data Protection Commissioner concerning the processing of his or her personal data by the City of Helsinki's social and health services. The processing of personal data has taken place in connection with the application for a voluntary child / young person support person. The data subject asks the Data Protection Officer to comment on the lawfulness of the processing of the personal data in question. Statement received from the data subject The registrant has applied to the City of Helsinki as a voluntary child / youth support person. The registrant has attended an interview with the social worker for support staff on 20 August 2020. In connection with the interview, he has given a power of attorney to request information from the police. Based on what has been said, he has understood that the power of attorney gives consent to apply for an extract from the criminal record. The interviewer had said that in addition to the criminal record extract, there will be information about home alarms. The data subject has exchanged correspondence on the matter by e-mail with the representatives of the data controller. Part of the correspondence has been delivered to the Office of the Data Protection Officer after a request for clarification has been sent to the controller. The relevant messages are set out below. Consultation of the data controller on this correspondence is manifestly unnecessary within the meaning of section 34 (2) (5) of the Administrative Procedure Act (434/2003), as the data controller's representatives have themselves been parties to the communication. On 27 August 202020, the registrant received a message from the registrar's representative, which belonged to e.g. as follows: “Your police information arrived yesterday and I was surprised when we received several investigation reports from you. You didn’t mention these old stuff in the interview, even though you’re certainly in all the roles involved. Do you still want to talk about these with me in more detail on the phone? ” On 28 August 202020, the registrant has received a message from the registrar's representative stating e.g. next “I can show those investigation notices to you the next time we meet and then put them in the shredder. The issues mentioned in the announcements have nothing to do with acting as a support person, and I have no need to address past issues if they have been addressed by you. Indeed, we have effective co-operation with the police and with the power of attorney you signed, the police will provide us with copies of the notification of all the cases of that person. This is a very important part of the selection process for us, when we assess who is suitable for our activities and who is not. ” It has been registered since 2.9.2020received a message from the registrar’s representative in response to his inquiry: “You are right that the more familiar law regarding volunteers working with children is the law on determining the criminal background of volunteers working with children. However, with regard to volunteers working independently with children, it has been seen as important to find out the background more comprehensively for the clients of special support under the City of Helsinki's Child Welfare and Social Welfare Act. An adult serving as a surrogate family, foster family, support family, or support person is often in contact with a child who has been traumatized or has special needs. It is therefore particularly important that the city, as a responsible actor, ensures that the child is safe to be with the adult volunteer trained for the task. Sometimes there are situationsthat the criminal record extract for a volunteer working with children does not provide sufficiently comprehensive information, but seeks to involve adults with, for example, a criminal background that does not appear in the criminal record extract in question. For this reason, applicants for support activities are asked for consent to request information from the police authority in accordance with section 20 (1) of the Act on the Status and Rights of Social Welfare Clients. In particular, the consent refers to the last sentence of the paragraph, which refers to the verification of the information provided to the authority.For this reason, applicants for support activities are asked for consent to request information from the police authority in accordance with section 20 (1) of the Act on the Status and Rights of Social Welfare Clients. In particular, the consent refers to the last sentence of the paragraph, which refers to the verification of the information provided to the authority.For this reason, applicants for support activities are asked for consent to request information from the police authority in accordance with section 20 (1) of the Act on the Status and Rights of Social Welfare Clients. In particular, the consent refers to the last sentence of the paragraph, which refers to the verification of the information provided to the authority. Naturally, information about an individual from the police is not retained, and information obtained during the coaching process is processed with the volunteer being coached. All other documents held by the city concerning the person are, of course, available to the person concerned, and a meeting with the relevant employee can be arranged for this purpose. As a result of your contact, we were still particularly critical of the consent form in use, as well as of the legal reference (mentioned above), I will consider whether the wording of the form drawn up with the Legal Service a few years ago is too imprecise. I will therefore contact the City of Helsinki's Legal Services unit to clarifywhether there have been any changes in the interpretation of this Article since the form was drawn up or whether the wording needs to be clarified further. ' It has been registered on 24.9.2020sent a message to the registrar's representative: I was looking at these documents I photographed in your office today. Your request for information from the police concerns "data in the police information system", without a time limit. Photographed documents are investigating three reported, that are recorded in the years 2015, 2016 and 2018, and all of which I am the injured party. These have been considered by you as necessary information within the meaning of the Social Welfare Act for support person activities, where a non-professional volunteer spends twice a month with a child / young person. For comparison, for example, a criminal record extract from a volunteer adult friend has been assessed as a sufficient explanation for a young person / child in a challenging life situation for similar work at the Helsinki Mission. Also on the SOS crisis phone,whose education I just started, and which is played by children and young people in a very challenging situation, has been considered a sufficient statement of a volunteer criminal record. Even with the power of attorney I have described, I have not given my consent to the retrieval of these investigative notices, but only to the criminal and criminal records. It is good that I finally got an answer to my inquiries today, although I did not receive copies of these documents from you on several occasions, nor did I explain why 13 pages could not be copied, but could only describe them on my phone. . In today's meeting, you mentioned "the end of our common journey" and I will make sure thatthat my eligibility for the fall support staff training has been canceled and I will therefore not be able to access the training starting in October? If so, could I still obtain a justification for this withdrawal of choice? I was of the opinion that this assessment of the appropriateness of the process has not been personified by you either, but has been able to deal with it. ” On 25 September 202020, the data subject has received a message from the data controller's representative: As the forerunner of the sub-unit, I do not consider it possible to participate in the activities, at least during this process. You can return to the matter once the process is in the decision, if it is still relevant for you. I do not see it as appropriate to conduct coaching with a person who has not yet received the written explanation he or she has requested and is being processed by the City of Helsinki in his or her request for clarification. It is necessary to complete such processes, regardless of the person, first. ” It has been registered on November 4, 2020received a message from the registrar's representative: “After your selection for support staff activities, we have reassessed your suitability for support staff activities for children and young people in the City of Helsinki. Based on the selection criteria, you are not suitable for this activity, ie we do not invite you to support person coaching. The reason for this is that at the meeting on 24 September 2020, you said that you would not be willing to continue to find out the background information (police information) that we require in our operations. An adult as a support person is often dealing with a traumatized or special needs child. For this reason, it is particularly important for the city, as a responsible actor (service provider and supervisor), to ensure that the child is safe to be with a trained adult volunteer.As for support staff, this is where your process ends. Statement received from the controller The Office of the Data Protection Officer has requested clarification from the controller. The report was received on 9.12.2020. The report has been issued by the City of Helsinki, Social and Health Care Division, Family and Social Services service entity, Director of Child Welfare. A report from the head of child protection services is attached to the report. The report states that there was a lack of clear guidelines for determining the background of support staff and that the forms contained errors. The City of Helsinki is updating the guidelines and renewing the forms. The old forms in use are attached to the report. In the opinion of the controller, on which provision is the activity described above based? The applicant for child support has been asked for written consent for the Helsinki Social and Health Services Child Welfare Support Personnel to request any criminal and punitive entries concerning the applicant, as well as home alerts and arrests from the police authority. It is in the best interests of the child that a person acting as a support person in accordance with section 28 of the Social Welfare Act does not have any previous entries in the police register because the child is in a vulnerable position according to his or her age and level of development. Children covered by support person activities (Section 28 of the SHL) are children in need of special support (Section 3 of the SHL) or children in need of protection (Section 27 of the Child Protection Act). An adult acting as a support person in accordance with section 28 of the Social Welfare Act is in contact with a child with special needs and who is often traumatized. It is therefore particularly important that the city, as a responsible actor, ensures that the child is safe to be with the adult volunteer trained for the task. The criminal record extract for a volunteer working with children does not provide sufficient information, but adults with, for example, backgrounds that do not appear in the criminal record extract in question (eg home alerts due to intoxication and intimate partner violence) have been sought. For these reasons, the processing of personal data received from the police in connection with criminal convictions and offenses is permitted under section 7 (1) (2) of the Data Protection Act, as the data are processed directly due to the statutory tasks referred to in section 6 (1). Personal data obtained from the police other than criminal convictions or offenses are processed in accordance with Article 6 (1) (e) of the Data Protection Regulation for the performance of a task in the public interest and are necessary and proportionate for the performance of social and health tasks. With which police department or representative has the controller agreed on the procedure described above. There is no agreement on the procedure with the police. The procedure is based on section 20 of the Social Welfare Clients Act: State and municipal authorities and other public bodies, Social Insurance Institution, Finnish Center for Pensions, pension fund and other pension institutions, insurance institutions, training providers, social service providers, at the request of the social welfare authority, free of charge and without prejudice to confidentiality provisions, information and explanations in its possession which have a material effect on the social welfare client relationship and which are necessary for the authority due to its statutory task (to determine the client's social welfare needs);for the organization of social welfare and the implementation of related measures, as well as for the verification of the information provided to the authority. Is the data controller aware of what is provided for in the Act on Determining the Criminal Background of Volunteers Working with Children (148/2014) We are aware of the law in place. In our operations, Section 5 of the Act on Determining the Criminal Background of Volunteers Working with Children is fulfilled, ie an extract from the criminal record is requested from the Legal Register Center. In addition, with the consent of the person intending to be a support person, we ask for other information about the applicant known to the police that is more detailed and necessary for the organization of social care. Any relevant contract documents with the police and a model of the power of attorney to be used should be attached to the report. The municipality has no separate agreement on the matter. The information is requested as a support person with the written consent of the applicant. The forms in use are incorrect in content and we have disabled them. New forms are being prepared. The registered counterparty The Office of the Data Protection Commissioner has requested a response from the data subject on the data controller's report, the response was received on 14 December 2020. The City of Helsinki's report states: "- the processing of personal data received from the police in connection with criminal convictions and offenses is permitted under section 7 (1) (2) of the Data Protection Act, as the data are processed immediately due to the statutory tasks referred to in section 6 (1). than personal data obtained from the police in connection with criminal convictions or offenses are processed in accordance with Article 6 (1) (e) of the Data Protection Regulation for the performance of a task in the public interest and are necessary and proportionate for the performance of social and health tasks. " On the other hand, the City of Helsinki's report emphasizes entries related to the applicant's criminal and violation background. On the other hand, the City of Helsinki has not made more specific time or topic limits to the personal information requested from the police about support persons. Crime and punishment entries also cover the person's own criminal reports as well as the sensitive personal data of the persons mentioned in these reports who are unknown to the City of Helsinki's support staff. in accordance with the attached image (co. document photographed in the City of Helsinki support person in the office 09.24.2020, when I went to check the personal data processed about me) the police on me "markings on police information system" are meant three investigations reported, all of which I am the injured party. The City of Helsinki support staff member himself stated in a message sent on 28 August 2020 that the "matters mentioned in these [investigation] notices had nothing to do with acting as a support person". Nevertheless, he inquired if I would like to discuss these announcements further in his message of 27 August 2020. This cannot be a proportionate processing of personal data. For example, at the Helsinki Mission in a similar voluntary support person operation for children who are challenging and covered by child protection support measures, only the criminal record is cleared from the voluntary support personnel. In the interview situation, when I was applying for a support person, I was told that the power of attorney I had signed, which was also attached to the City of Helsinki report, sought the applicant's criminal record and information about home alarms. According to an additional information request criminal reports, which I myself am the injured party, came to me, therefore, fully yllättyksenä and shock. I also did not receive copies of these police papers procured by the City of Helsinki's support staff when I asked for them, although I was able to take photos of them while visiting the site to see the documents. Applicable provisions and assessment Application of the Act on the Processing of Personal Data of Volunteers Working with Children (148/2014) 1. Pursuant to Article 10 of Data Protection Regulation (EU) 2016/679, the processing of personal data relating to criminal convictions and infringements or related security measures pursuant to Article 6 (1) shall be carried out only under the supervision of an authority or permitted by Union law or national law providing for appropriate safeguards. to protect rights and freedoms. A comprehensive criminal record is kept only under the supervision of a public authority. 2. Prior to the entry into force of the Data Protection Regulation, information concerning a criminal offense, punishment or other criminal sanction was provided as sensitive personal data on the basis of section 11 (1) (3) of the Personal Data Act (523/1999). 3. The Data Protection Regulation is the law directly applicable in the Member States. However, Article 6 (2) of the Data Protection Regulation allows for more detailed provisions to adapt the provisions of the Regulation when the processing of personal data is necessary to comply with a legal obligation of the controller (Article 6 (1) (c)) or to perform a public interest task or exercise public authority paragraph (e)). Article 6 (3) of the Data Protection Regulation requires that the basis for the processing of personal data in such situations be laid down in Union law or in the law of the Member State applicable to the controller. Such legislation may include provisions on, inter alia, the type of data to be processed, the data subjects, the parties,to whom and for which purposes personal data may be disclosed. 4. In its opinion PeVL7 / 2019 (vp), the Committee on Constitutional Affairs stated: freedoms. As a result, the Committee has paid particular attention to the fact that the processing of sensitive data should be limited to what is necessary by precise and precise provisions (see, for example, PeVL 3/2017 vp., P. 5). In the committee's more recent practice, such a delimitation has been considered a matter of order of adjustment (see, for example, PeVL 15/2018 vp, p. 40).According to the Committee on Constitutional Affairs, the regulation of the processing of sensitive data, within the framework allowed by the Data Protection Regulation, should continue to be assessed also on the basis of the practice of legality of previous regulation. However, the need for more detailed legal regulation than the General Data Protection Regulation must also be justified on a case-by-case basis within the framework of the Data Protection Regulation. With regard to the need for regulation, attention should also be paid to the risk-based approach adopted in the regulation. The Committee emphasizes that clear and comprehensible legislation should also be sought with regard to the regulation of the processing of sensitive personal data (PeVL 14/2018 vp, pp. 5-6).However, the need for more detailed legal regulation than the General Data Protection Regulation must also be justified on a case-by-case basis within the framework of the Data Protection Regulation. With regard to the need for regulation, attention should also be paid to the risk-based approach adopted in the regulation. The Committee emphasizes that clear and comprehensible legislation should also be sought with regard to the regulation of the processing of sensitive personal data (PeVL 14/2018 vp, pp. 5-6).However, the need for more detailed legal regulation than the General Data Protection Regulation must also be justified on a case-by-case basis within the framework of the Data Protection Regulation. With regard to the need for regulation, attention should also be paid to the risk-based approach adopted in the regulation. The Committee emphasizes that clear and comprehensible legislation should also be sought with regard to the regulation of the processing of sensitive personal data (PeVL 14/2018 vp, pp. 5-6). 5. The processing of personal data to establish the criminal background of volunteers working with children is regulated by a special law. Pursuant to Section 2 of the Act on Determining the Criminal Background of Volunteers Working with Children, this Act provides for a procedure for determining the criminal background of volunteers working with minors. 6. According to the preliminary works of the Act (HE 149/2013 vp 13), the aim of the proposal is to safeguard the child's personal integrity in voluntary activities and thus to promote and secure the child's growth, development and well-being. The aim is to contribute to safeguarding the fundamental and human rights of the child and to protect the child from sexual exploitation and exploitation, as well as from other serious violent crimes and incitement to use drugs. At the same time, the aim is to respect the protection of the privacy and personal data of those involved in volunteering. The conditions for surrender of a criminal record must be acceptable and well-defined. According to the proposal, an extract could be requested by the organizer of the volunteer task with the consent of the volunteer.The operational objective of the legislation is to create a proportionate and appropriate procedure for both the organizers of voluntary activities and the Legal Register Center. 7. Furthermore, according to the preliminary works of the law (PeVL 37/2013 vp), it is essential for the requirement of proportionality that applying for an extract from the criminal record requires the consent of the volunteer. In addition, information on only the offenses proposed to be listed in section 6 (2) of the Criminal Records Act that are relevant for the purposes of regulation shall be entered in the extract from the criminal record. Requesting an extract from the criminal record is also not the primary means of protecting the personal integrity of minors in voluntary activities, but the organizer of the voluntary task must first take the measures to ensure the integrity referred to in section 4 of the draft law. The applicant for a criminal record extract must notify the Legal Register Center of these actions.The organizer of the volunteer task may only make entries in the personal data of the volunteer about the verification of the extract and its identification data, and no copy of the extract may be taken. In addition, the bill contains provisions on confidentiality and the release of an extract from the criminal record immediately after the case has been dealt with to the volunteer concerned by the extract. There are no comments on the proposed regulation in terms of its proportionality. 8. Under Article 4 of the Law on the criminal background of volunteers working with children, the organizer of a voluntary task must establish instructions or procedures concerning his activities which are necessary to achieve the purpose of that law and assess the voluntary tasks for which the volunteers are to be investigated. 9. According to the preliminary work of the above-mentioned law (LaV 16/2013 vp), the committee considers the extension of criminal background research to volunteering as an important additional means of protecting children from crimes endangering their safety. However, the deterrent effect of criminal background checks is limited, whether it is a voluntary or mandatory system. This is because the criminal record extract only shows the convictions of the person at the time of requesting the extract. In a situation where a person has not been convicted of a crime at the time of requesting an extract, for example because the crime has not been revealed or is still under investigation, there is no record of the crime in the extract from the criminal record. The information will also be deleted from the criminal record after a certain period of time has been given. An unmarked criminal record extract is also not a guarantee thatthat the person will not commit such offenses in the future. It should also be noted that only a very small proportion of the extracts from the criminal record applied to the Center for Legal Registers contain a reference to the judgment (0.1%). Effective protection of the integrity of children therefore also requires means other than the establishment of a criminal record. In this regard, the Committee particularly welcomes the provision proposed in the draft that the organizer of a voluntary activity must establish guidelines and procedures for his or her activities regarding measures to protect the personal integrity of minors (Article 4 of the draft law). Such general and ongoing guidelines and procedures are more effective in determining the background of a crime to protect children. This obligation only applies to organizers of voluntary activities who:who intend to take advantage of the opportunity to establish a criminal background. 10. According to the data controller's report, the processing of personal data received from the police in connection with criminal convictions and offenses would be permitted under section 7 (1) (2) of the Data Protection Act, With regard to the task provided by law, the registrar refers to section 28 of the Social Welfare Act (2014/1301), which provides for other social services as follows: 11. The registrar has introduced a procedure in which it requests information from the police on the possible criminal and punitive entries of a person seeking support for a child / young person on the basis of section 20 of the Act on the Status and Rights of Social Welfare Clients. However, instead of this procedure, the controller should take the measures prescribed in section 4 of the Act on the Determination of the Criminal Background of Volunteers Working with Children, as described above. 12. In the light of the above, the criminal background and related procedure of volunteers working with children is regulated by a special law, the controller cannot introduce regular parallel procedures on the basis of more general legislation and process criminal data more widely than the special law allows. Such a procedure would render irrelevant the special law enacted in the matter and would override the requirements of precision, accuracy and proportionality arising from this law, as well as the other aspects raised above in connection with the preparation of the Parliamentary Law. Application of the Act on the Status and Rights of Social Welfare Clients (812/2000) 13. According to the registrar's report, the investigation of the criminal background of volunteers working with children is fulfilled in its operations, ie an extract from the criminal record is requested from the Legal Register Center. In addition, with the consent of the person intending to act as a support person, the controller requests other information known to the police about the applicant that is more detailed and necessary for the organization of social care. According to the data controller's report, the police will provide the data controller with copies of the notification of all cases of that person. 14. The data subject has been asked for consent to retrieve police information. Consent has not been voluntary as required by the Data Protection Regulation, as the controller has informed the data subject that he or she is not suitable for child and youth support staff because he or she has not consented to the disclosure of police data. Recital 43 of the Data Protection Regulation states: In order to ensure that consent is given voluntarily, consent should not be a valid legal basis for the processing of personal data in a specific situation where there is a clear discrepancy between the data subject and the controller. This applies in particular to a situation where the controller is a public authority and it is therefore unlikely thatthat consent has been given voluntarily in all the circumstances of the situation. Section 20 of the Act on the Status and Rights of Social Welfare Clients does not require the data subject's consent to obtain the information, but the basis for processing the information becomes the applicable special legislation. Consent cannot therefore be the basis for the processing of personal data in the present case. Consent could at most be considered a safeguard measure in accordance with section 6 (2) of the Data Protection Act.n as a safeguard in accordance with subsection 2.n as a safeguard in accordance with subsection 2. 15. According to the registrar, obtaining information from the police is based on Chapter 4, Section 20 of the Act on the Status and Rights of Social Welfare Clients (812/2000), paragraph 1 of which states that the organizer, the social service provider, the health and medical care entity or business unit and the health care professional are obliged to provide the social care authority free of charge and without prejudice to secrecy provisions.for the organization of social welfare and the implementation of related measures, as well as for the verification of the information provided to the authority. 16. Section 20 of the Act on the Status and Rights of Social Welfare Clients provides for the possibility of obtaining necessary information essentially related to the social welfare client relationship. According to section 3 (1) (2) of the Social Welfare Act (1301/2014), a social welfare client means a person who applies for or uses social welfare or who is the subject of it, regardless of his or her will. A person who wants to become a voluntary support person is therefore not a social care client. Criminal information about a support person is not mentioned in the law or its preamble, and there are no special provisions other than the law on determining the criminal background of volunteers working with children. Section 20 of the Act on the Status and Rights of Social Welfare Clients makes it possible to obtain personal data only in individual cases,where it has been found necessary at its discretion. 17. The controller has requested personal data from the police from a person who regularly applies for a child / young person support person with a form titled as a request for official assistance. The form asked for information about a person’s possible criminal and criminal records (e.g., home alerts, arrests). The form did not specify or limit which information the request concerns. When requesting information, it has not been assessed which information would be necessary for the data controller's statutory task. 18. The need for information should be considered on a case-by-case basis. In the case in question, the controller has received investigation notices from the police in which the data subject is an interested party. The controller has started processing the notifications and asked the registrant to discuss them with the controller 's representative. However, the controller's representative has subsequently stated that the matters mentioned in the notifications have nothing to do with acting as a support person. The personal data processed were therefore not necessary or even necessary for the authority due to the statutory task. 19. In view of the above, the controller has not had the right to obtain or process the personal data of the data subject in question. The controller has acted in a manner inconsistent with the above by creating a policy whereby the police regularly request and receive all police records of persons applying for voluntary child / youth support. Planning and guidelines for the processing of personal data 20. According to the registrar's report, the forms used are incorrect in content and have been taken out of service. According to the report, there is a lack of clear guidelines on the processing of personal data in support personnel activities. The City of Helsinki has announced that it will update the guidelines and renew the forms in question. On the basis of the information received, the data subject has not been informed about the processing of personal data as provided for in Article 12 of the Data Protection Regulation. 21. The procedure has been unclear, the data subject has been asked for consent to request information from the police. Consent has not been voluntary, as required by Article 6 (1) of the Data Protection Regulation, and its meaning in the context of the statutory right of access remains unclear. Note and order of the Assistant Supervisor I will issue a remark to the controller in accordance with Article 58 (2) (b) of the Data Protection Regulation, as the processing of the controller's personal data has been in breach of Articles 5, 6, 10, 12 and 25 of the Data Protection Regulation. Pursuant to Article 58 (2) (d) of the Data Protection Regulation, the controller shall order the processing of personal data in accordance with this Regulation within 30 days of notification of this Decision so that personal data are no longer processed in breach of Articles 5, 6, 10, 12 and 25. The processing of personal data in question is regulated by a specific law within the meaning of Article 10 of the Data Protection Regulation. In addition to this special provision, the controller has, in non-justified individual cases, introduced policies in which personal data are regularly processed more extensively than provided for in the special law. There have been no grounds for such processing within the meaning of Article 6 of the Data Protection Regulation. In so doing, the controller has processed personal data in breach of Articles 6 and 10 of the Data Protection Regulation (paragraphs 1 to 12 above). The controller has not taken the technical and organizational measures required by Article 25 of the Data Protection Regulation to ensure that, by default, only personal data necessary for each specific purpose of the processing are processed. The controller has not planned the processing of personal data in the manner referred to in Article 25 (1) of the Regulation and has defined the methods of processing personal data and has effectively implemented the data protection principles by implementing e.g. data minimization and organizational measures to ensure that processing complies with the requirements of the Data Protection Regulation and that the rights of data subjects are protected (paragraphs 20 to 21 above). In so doing, the controller has processed personal data in breach of Article 25 of the Data Protection Regulation. The data processed by the controller in criminal cases in which the controller is a party have not been necessary or even necessary for the purposes for which the controller has processed them. Thus, in breach of the Data Protection Regulation and the specific provision described above, the controller has processed personal data which were not necessary or even necessary for the controller's duties. In so doing, the controller infringed Article 5 (1) (a) and (c) of the Data Protection Regulation (paragraphs 13 to 19 above). The data subject has not been informed of the processing of personal data as required by Article 12 of the Data Protection Regulation (paragraphs 20 to 21 above). Other measures This decision does not assess the activities of the police in relation to the processing of personal data, in particular the transfer of data. In accordance with the inspection plan of the Office of the Data Protection Officer (dnro 10253/164/20), the disclosure of personal data to the authorities in individual cases will be subject to inspection in the Helsinki Police Department in 2021. The decision will therefore be sent to the Police Board and the Helsinki Police Department. The decision is sent to the Ministry of Social Affairs and Health for information for a possible assessment of the timeliness of the legislation, as the decision concerns the interpretation of section 20 of the Act on the Rights and Status of Social Welfare Clients. The decision will also be sent to the Equality Ombudsman for information upon request. The decision is not yet final.
