Helsingin hallinto-oikeus (Finland) - H5259/2022
From GDPRhub
| Helsingin hallinto-oikeus - H5259/2022 | |
|---|---|
 | |
| Court: | Helsingin hallinto-oikeus (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 6 GDPR Article 6(1)(c) GDPR Article 6(2) GDPR Article 10 GDPR § 5 Act on Checking the Criminal Background of Persons Working with Children Child Welfare Act Social Welfare Act |
| Decided: | 23.09.2022 |
| Published: | 28.09.2022 |
| Parties: | City of Helsinki |
| National Case Number/Name: | H5259/2022 |
| European Case Law Identifier: | |
| Appeal from: | Tietosuojavaltuutetun toimisto (Finland) 6689/186/20 |
| Appeal to: | Not appealed |
| Original Language(s): | Finnish |
| Original Source: | Helsingin hallinto-oikeus (in Finnish) |
| Initial Contributor: | fred |
The Administrative Court of Helsinki upheld a Finnish DPA decision, which found that the social and health authority of a city to had breached Article 6 GDPR and Article 10 GDPR by requesting data subjects to provide it with personal data that it had no legal basis for processing.
English Summary
Facts
The social and health authority of the city of Helsinki (the controller) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the background information of applicants applying to volunteer as a child support person.
The controller filed the appeal claiming that the processing of personal data was necessary to comply with its legal obligations under Article 6(1)(c) GDPR. The controller claimed that the Finnish Social Welfare Act and the Finnish Child Welfare Act oblige and entitle it to extensively process the background information of support person applicants, on the basis of which it can be assessed if they pose a threat to the child's physical and psychological integrity.
Holding
The Court agreed with the controller that determining the background of volunteers working with children could be considered necessary in order to fulfil its obligations under the Finnish Social Welfare Act and the Finnish Child Welfare Act.
However, the Court noted that pursuant Article 6(2) GDPR, the processing of personal data related to the organisation of support person activities is regulated in more detail in Section 5 of the Finnish Act on Checking the Criminal Background of Persons Working with Children, according to which the municipality may only request an extract from the criminal record from the applicant.
In light of this, the Court agreed with the DPA that the personal data processed by the controller had exceeded what was necessary and relevant for the original purpose of the processing, therefore violating Article 6 GDPR and Article 10 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
HELSINKI ADMINISTRATIVE COURT 23 September 2022 DECISION H5259/2022 ID number 20903/03.04.04.04.01/2021 Case A complaint regarding a data protection case Appellant City of Helsinki You can appeal the decision by appealing to the Supreme Administrative Court, if the Supreme Administrative Court grants an appeal permit (HOL appeal permit 30). Decision to be appealed Deputy data protection officer 15 January 2021 ID number 6689/186/20 On August 28, 2020, the data subject has submitted a request for action to the data protection commissioner's office, in which he has asked the data protection commissioner to take a position on the legality of the processing of his personal data in the social and health sector of the city of Helsinki (later the controller). The processing of personal data has taken place when the data subject has applied to be a voluntary child support person. On August 20, 2020, in an interview with the social worker of support staff, he gave a power of attorney to request his information from the police authority. The registered person has understood that the power of attorney gives consent to request a criminal record extract. According to the interviewer, you also get information about home alarms. In his response on December 14, 2020, the registered person has pointed out that he has come as a surprise that the City of Helsinki's support staff has received from the police investigation notices registered in .2015, .2016 and .2018, in which he is the interested party. In a message sent on August 28, 2020, the employee of the support person operation has stated that the matters mentioned in the notifications in question have nothing to do with acting as a support person, but has nevertheless inquired about the registrant's desire to discuss the notifications in a previous message. The registrar's representative has also stated that with the power of attorney signed by the data subject, the police will provide copies of reports on all the applicant's cases. In its decision under appeal, the Deputy Data Protection Commissioner has assessed the matter regarding the processing of registered personal data on the basis of the Act on investigating the criminal background of volunteers working with children (148/2014) and the Act on the status and rights of social care clients (812/2000). In its decision under appeal, the Deputy Data Protection Commissioner has issued a notice to the data controller in accordance with Article 58, paragraph 2, subparagraph b of the Data Protection Regulation, because the data controller's personal data processing activities have been in violation of Articles 5, 6, 10, 12 and 25 of the Data Protection Regulation, and ordered in accordance with Article 58, paragraph 2, subparagraph d of the Data Protection Regulation the data controller to bring the personal data processing operations into compliance with the provisions of this regulation within 30 days of notification of this decision so that personal data is no longer processed in violation of articles 5, 6, 10, 12 and 25 of the data protection regulation. The decision states, among other things, the following regarding the violation of Articles 6 and 10: The registrar has implemented a procedure in which it requests information from the police about the possible criminal and penal records of a person seeking to be a child's support person, based on § 20 of the Act on the Status and Rights of Social Care Clients. Instead of this procedure, the registrar should implement the measures prescribed in Section 4 of the Act on investigating the criminal background of volunteers working with children. The investigation of the criminal background of volunteers working with children and the procedure related to it is regulated by a special law, and the registrar cannot introduce regular parallel procedures based on more general legislation and process criminal data more widely than the special law allows. Such a procedure renders the special law on the matter meaningless and would, among other things, supersede the strictness, precision and proportionality requirements of this law. Section 20 of the Act on the Status and Rights of Social Care Clients provides for the possibility of obtaining necessary information that is essentially related to the social care client relationship. According to Section 3, Subsection 1, Clause 2 of the Social Welfare Act (1301/2014), a social welfare client means a person who applies for or uses social welfare or is subject to it regardless of their will. A person who wants to be a volunteer support person is therefore not a client of social care. Criminal information regarding a person working as a support person is not mentioned in the law or its preambles, and there are no other special provisions on the matter other than the law on investigating the criminal background of volunteers working with children. Section 20 of the Act on the Status and Rights of Social Care Clients allows access to personal data only in individual cases where it has been determined to be necessary based on consideration. The processing of personal data in question is regulated in the Act on investigating the criminal background of volunteers working with children (148/2014) as referred to in Article 10 of the Data Protection Regulation. In addition to this special provision, the controller has, in other than justified individual cases, implemented practices in which personal data is processed more widely than is stipulated in the relevant special law. There have been no grounds for such processing as referred to in Article 6 of the Data Protection Regulation. By acting in this way, the controller has processed personal data in violation of Articles 6 and 10 of the Data Protection Regulation. Claims presented in the complaint The decision must be annulled to the extent that it has been deemed that the controller acted in violation of Articles 6 and 10 of the Data Protection Regulation. In his decision on the processing of information related to the investigation of criminal background, the Deputy Data Protection Commissioner has considered that the data controller has acted in violation of, among other things, articles 6 and 10 of the Data Protection Regulation in his practice of processing personal data in other than justified individual cases to a greater extent than is stipulated in the special law. In addition to a criminal record extract, regular information requests to the police in accordance with Section 20, subsection 1 of the Act on the Status and Rights of Social Care Clients, when evaluating the suitability of volunteers who aspire to be child support workers. The data protection commissioner does not have the authority to legally assess the social care authority's use of the right to access information based on the law. The basis for the information requests has been the necessity of the personal data in question to comply with the legal obligation of the controller, so the processing of the personal data has been lawful based on Article 6, Section 1, Subsection c of the Data Protection Regulation. Paragraph 1 of Section 4 of the Child Protection Act obliges child protection authorities to take the child's best interests into account when organizing child protection. When evaluating this interest of the child, it must be taken into account how the different solution options secure for the child, for example, balanced development, a safe growth environment and physical and mental integrity. Support person activity is a social service that the municipality must organize on the basis of Section 14 subsection 1 and Section 28 of the Social Welfare Act. The obligation to organize is also based on section 36 subsection 1 of the Child Protection Act. Support person activities are aimed at children in need of special support as referred to in section 3, paragraph 6 of the Social Welfare Act, who are in a vulnerable position and who, in addition, are clients of child welfare services due to the endangerment of their growing conditions or behavior that endangers their own health and development (section 27 subsection 1 of the Child Protection Act). The aforementioned provisions oblige and entitle the child protection authorities to process background information of persons applying for support person activities other than those that may appear from the criminal record extract, on the basis of which it can be assessed that they pose a threat to the child's physical and psychological integrity. Insofar as it has been, for example, information about police home alarms concerning a person intending to be a support person, the procedure has not been in violation of Article 10 of the Data Protection Regulation, because the information in question does not relate to criminal convictions or violations referred to in Article 10, or related security measures. The controller considers, unlike the deputy data protection commissioner, that the right of access to information stipulated in section 20 subsection 1 of the Social Care Customer Act does not only apply to the data of a person who is a customer of social care. The regulation requires that the requested information has a significant impact on the customer relationship and is necessary for the authority due to the task stipulated in the law, for example to organize social care. The information held by the police regarding the background of those who apply to be support persons is essential for the child's customer relationship. The obligation to organize support person activities is based on Section 28 of the Social Welfare Act and Section 36 of the Child Protection Act. Ensuring the child's safety is a necessary condition for organizing support person activities, which also requires obtaining information that is not reflected in the criminal record extract. Case handling and investigation The Deputy Data Protection Commissioner has presented the following in his statement, among other things: The duties of the data protection officer are stipulated in Article 57 of the Data Protection Regulation (EU) 2016/679 and in Section 14 of the Data Protection Act (1050/2018). According to Article 57, paragraph 1, subparagraph a of the Data Protection Regulation, the data protection authority must supervise the application of this regulation in its territory. The statement also refers to introductory paragraph 122 of the data protection regulation. The data protection regulation can be supplemented with special legislation on the processing of personal data. To the extent that the Act on the Status and Rights of Social Care Clients (812/2000) contains provisions regarding the processing of personal data, it is a provision in accordance with Article 6, Section 2 of the Data Protection Regulation, which supplements the provisions of the Data Protection Regulation. Most of the processing of personal data in the activities of the authorities is otherwise regulated by special laws, the supervision of which is the responsibility of the Data Protection Commissioner. Home alarm is not a precise concept defined in the law. As a rule, the issue is the performance of a task related to maintaining public order and security. Section 5 of the Act on the Processing of Personal Data in Police Operations (616/2019) applies to the processing of personal data related to such a task. The information provided to the City of Helsinki related to the police's investigation and surveillance tasks falls within the scope of Article 10 of the Data Protection Regulation. In the decision under appeal, a position has been taken on the application of Section 20, subsection 1 of the Social Care Customer Act, insofar as the issue is the processing of personal data related to the investigation of criminal background in connection with the activities of children's support staff. The decision has not evaluated the application of the aforementioned provision more widely. In its counter-explanation, the city of Helsinki has presented, among other things, the following: In its decision under appeal, the Deputy Data Protection Commissioner considered that the social and health sector acted in violation of Article 10 of the Data Protection Regulation regulating the processing of personal data regarding criminal convictions and violations when it requested information from the police on the basis of Section 20 of the Social Care Customer Act about home alarms for persons intending to be support workers. In his statement, the Deputy Data Protection Commissioner states that Section 5 of the Act on the Processing of Personal Data in Police Operations applies to the personal data in question and considers that the data in question falls within the scope of Article 10 of the Data Protection Regulation. In criminal convictions and violations, there is a question of behavior that violates the norm and the penalty resulting from it according to the law, while, for example, the police's home alarm duties are generally only related to safeguarding public order without being involved in crimes or violations. A criminal record extract is not sufficient when trying to ensure the safety of a child or young person. Also, the instructions and procedures for protecting the integrity of clients referred to in Section 4 of the Act on investigating the criminal background of volunteers working with children are not comprehensive to ensure the suitability of persons applying to be support staff. For this reason, the police are asked for registry information about the background of the person who wants to become a volunteer support person. Based on the above, the regular request for background information from the police on the basis of Section 20 subsection 1 of the Social Care Customer Act of those applying to become a support person applies to information that has a material effect on the customer relationship, as intended in the provision, which is necessary for the industry's support person activities due to the task stipulated in the law in order to organize the customer's social service. The procedure does not conflict with Article 6 or 10 of the Data Protection Regulation. The registrant has given an explanation. The city of Helsinki has given a counter-explanation. Administrative law solution The administrative court rejects the appeal. Reasoning Applicable legal guidelines According to Article 5(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons in the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (General Data Protection Regulation), personal data must be processed in accordance with the law, properly and transparently for the data subject. Article 6 of the General Data Protection Regulation provides for the legality of personal data processing. According to paragraph 1 of the article, processing is lawful only if and only to the extent that at least one of the following conditions is met: a) the data subject has given his consent to the processing of his personal data for one or more specific purposes; b) the processing is necessary for the implementation of an agreement to which the data subject is a party, or for the implementation of measures prior to the conclusion of the agreement at the request of the data subject; c) the processing is necessary to comply with the legal obligation of the controller; d) the processing is necessary to protect the vital interests of the data subject or another natural person; e) the processing is necessary for the performance of a task in the public interest or for the exercise of public authority vested in the controller; f) the processing is necessary for the realization of the legitimate interests of the controller or a third party, except when the interests of the data subject requiring the protection of personal data or fundamental rights and freedoms supersede such interests, especially if the data subject is a child. Subparagraph f of the first subparagraph does not apply to data processing carried out by public authorities in connection with their duties. According to paragraph 2 of the article, Member States may maintain or introduce more detailed provisions to adapt the application of the rules laid down in this Regulation to the processing carried out to comply with points (c) and (e) of paragraph 1 by specifying more precisely the specific requirements for data processing and other measures that ensure the legal and appropriate processing of data, inter alia in other special processing situations as stipulated in Chapter IX. According to paragraph 3 of the article, the basis of the processing referred to in points c and e of paragraph 1 above must be determined either a) in Union law; or b) in the legislation of the Member State applicable to the data controller. The purpose of the processing is defined in the relevant legal basis for the processing or, in the processing referred to in point 1, point e, it must be necessary for the performance of a task in the public interest or for the exercise of a public authority vested in the controller. The legal basis for the processing in question may contain special provisions that adjust the application of the rules of this regulation, including: general conditions regarding the legality of the data processing performed by the data controller; the type of data processed; relevant data subjects, entities to which and purposes for which personal data may be disclosed; purpose-relatedness; retention periods; and processing actions and procedures, including measures intended to ensure legal and appropriate data processing, such as measures for other special data processing situations presented in Chapter IX. Union law or Member State legislation must fulfill an objective in the public interest and be proportionate to the legitimate aim it pursues. Article 10 of the General Data Protection Regulation provides for the processing of personal data related to criminal convictions and violations. According to the article, the processing of personal data related to criminal convictions and violations or related security measures, on the basis of Article 6 paragraph 1, is carried out only under the supervision of an authority or when it is permitted by Union law or the legislation of a Member State, which provides for appropriate safeguards to protect the rights and freedoms of the data subject. A comprehensive criminal record is only kept under the supervision of a public authority. According to Article 58(2) of the General Data Protection Regulation, each supervisory authority has, among other things, the authority to: b) issue a notice to the controller or personal data processor if the processing operations have been in violation of this regulation; d) order the controller or personal data processor to bring the processing activities into compliance with the provisions of this regulation, if necessary in a certain way and within a certain deadline. According to Section 6, Subsection 1, Clauses 1, 2 and 7 of the Data Protection Act, Article 9, Clause 1 of the Data Protection Regulation does not apply: 1) information obtained in the course of the insurance business, processed by the insurance institution, about the state of health, illness, or disability of the insured and the claimant, or about the treatment measures applied to him or comparable actions, which are necessary to clarify the liability of the insurance institution; 2) for the processing of data, which is stipulated by law or which directly results from the task prescribed by law for the controller; 7) for data processing for scientific or historical research or statistics. According to Section 7, subsection 1 of the Data Protection Act, personal data related to criminal convictions and violations referred to in Article 10 of the Data Protection Regulation or related security measures may be processed if: 1) the processing is necessary for the investigation, preparation, presentation, defense or settlement of a legal claim; or 2) the data is processed for the purpose stipulated in section 6 subsection 1, section 1, 2 or 7. According to Section 20(1) of the Act on the Status and Rights of Social Care Clients, a state and municipal authority and other public law entity, the National Pension Institute, pension insurance center, pension foundation and other pension institution, insurance institution, training provider, social service provider, entity or operating unit engaged in health and medical care activities and health care the professional person is obliged to provide the social care authority, at its request, free of charge and without prejudice to confidentiality regulations, the information and reports in their possession that have a material effect on the social care customer relationship, which are necessary for the authority to determine the customer's need for social care, to organize the social care and to implement related measures, and to check the information given to the authority due to the task set out in the law. According to Section 2, subsection 1 of the Act on investigating the criminal background of volunteers working with children, this law provides for a procedure for investigating the criminal background of volunteers working with minors. According to § 4 of the same law, the organizer of a volunteer task must create instructions or procedures for their activities that are necessary to fulfill the purpose of this law and evaluate the volunteer tasks for which the criminal background of the volunteers to be selected is to be investigated. According to Section 5, subsection 1 of the same act, the organizer of a volunteer task has the right to request from the Legal Registry Center a criminal record extract referred to in Section 6, subsection 2 of the Criminal Records Act (770/1993) of the volunteer, if the organizer of the volunteer task is giving the volunteer a task that includes: 1) regularly and essentially a minor teaching, guidance, care, care or other contact with a minor; 2) personal interaction with the minor; and 3) performing the task alone or in such circumstances where the personal integrity of the minor cannot be reasonably protected despite the actions referred to in Section 4 of this Act. According to Section 6, subsection 1 of the same law, the issuance of a criminal record extract requires that the volunteer has given prior written consent to the extract. According to section 2, the consent must state that, before giving consent, the volunteer has received information about the purpose of the criminal record extract and its use, the information relevant to the criminal record extract and related data processing, the obligation of the organizer of the volunteer task to hand over the extract to the volunteer, and, if necessary, that the criminal record extract is requested on behalf of the organizer of the volunteer task 8 association referred to in subsection 1 of §. Claim regarding the competence of the data protection officer In its appeal, the City of Helsinki's social and health department has submitted that the data protection commissioner does not have the authority to legally assess the social welfare authority's use of the right to access information based on the law. The Administrative Court notes that Article 57 of the Data Protection Regulation (EU) 2016/679 provides for the duties of the data protection officer and Article 58 provides for the investigative powers of the supervisory authority. According to Article 57, paragraph 1, subparagraph a of the Data Protection Regulation, the data protection authority must supervise the application of this regulation in its territory. The duties and powers of the data protection officer are also stipulated in Section 14 of the Data Protection Act (1050/2018). The data protection regulation applies to the processing of personal data carried out by the social welfare authority in question, but also the provisions of the national legislation regarding the processing of personal data, which in part supplement the regulation of the data protection regulation. Such are, for example, § 20 of the Act on the Status and Rights of Social Care Clients and the Act on Criminal Background Investigation of Volunteers Working with Children. Even when it comes to the application of the mentioned provisions supplementing the General Data Protection Regulation, it is still a matter of personal data processing falling within the scope of the Data Protection Regulation. The Administrative Court considers that, based on the above, the data protection commissioner has the right to evaluate the processing of personal data carried out by the social authority in question and to monitor compliance with the data protection regulation, regardless of whether the processing takes place on the basis of the law on the status and rights of social care clients or the law on investigating the criminal background of volunteers working with children. There is no reason to overturn the decision under appeal based on the argument about jurisdiction. Issue The registrant has initiated a case at the data protection commissioner's office, which is about whether the processing of his personal data by the City of Helsinki's child welfare support staff has been lawful. The registered person had applied to be a voluntary child support person and gave a power of attorney in the interview to request his information from the police. He had understood that the power of attorney gives consent to request a criminal record extract. According to the report given by the registrar on December 9, 2020, written consent has been requested from the person applying to become a support person, that the support person activities can ask the police authority for possible criminal and punishment records concerning the applicant. It has come as a surprise to the registered person that the support person operation has received information from the police about three investigation reports from the years 2015, 2016 and 2018, in which he has been an interested party. In its decision under appeal, the Deputy Data Protection Commissioner has issued a notice to the City of Helsinki in accordance with Article 58(2)(b) of the Data Protection Regulation, because the data controller's personal data processing activities have, among other things, been contrary to Articles 6 and 10 of the Data Protection Regulation and ordered the data controller to send the personal data in accordance with Article 58(2)(d) of the Data Protection Regulation processing operations to comply with the provisions of this regulation within 30 days of notification of this decision, so that personal data is no longer processed in violation of the mentioned articles of the data protection regulation. In the matter, following a complaint from the Social and Health Department of the City of Helsinki, it is being assessed whether the data controller has acted in accordance with Articles 6 and 10 of the Data Protection Regulation when processing the data subject's personal data. According to the complaint, support staff activities are social services that the municipality must organize based on Section 14 subsection 1 and Section 28 of the Social Welfare Act and Section 36 subsection 1 of the Child Welfare Act. Support person activities are aimed at children in need of special support referred to in section 3, paragraph 6 of the Social Welfare Act and children who are clients of child protection referred to in section 27, paragraph 1 of the Child Welfare Act. The city of Helsinki has considered that the aforementioned provisions entitle the child welfare authorities to process information other than the criminal record extract of persons applying for support worker activities, on the basis of which they can be assessed as a threat to the child's integrity. According to the City of Helsinki, the processing of personal data received from the police related to criminal convictions and violations is permitted on the basis of Section 7, Subsection 1, Subsection 2 of the Data Protection Act, because the data is processed immediately due to the duties stipulated in the Act referred to in Section 6, Subsection 1, Subsection 2. Personal data other than those related to criminal convictions or violations received from the police are processed in accordance with Article 6, paragraph 1, subparagraph c of the Data Protection Regulation for the performance of a task in the public interest, and the processing is necessary and proportionate for the performance of tasks in the social and health sector. According to the City of Helsinki, the criminal record extract requested on the basis of Section 5 of the Act on Investigating the Criminal Background of Volunteers Working with Children or the instructions and procedures referred to in Section 4 of the Act to protect the integrity of minors are not comprehensive enough to ensure the suitability of those applying to become support staff. For this reason, the police are asked to obtain other information about the applicant that is more detailed and necessary for the organization of social care with written consent. The police will deliver to the City of Helsinki copies of the notices regarding all matters of the applicant in question. An agreement has not been made with the police about the procedure, but the procedure is based on § 20 of the Act on the Status and Rights of Social Care Clients. According to the General Data Protection Regulation, there must be a legal basis referred to in Article 6 for the processing of personal data. The Administrative Court states that support staff activities are stipulated as an obligation of the municipality in the Social Welfare Act and the Child Protection Act. The Administrative Court also states that finding out the backgrounds of volunteers working with children is necessary to fulfill the authority's statutory task. The processing of personal data for this purpose is therefore based on Article 6(1)(c) of the Data Protection Regulation. The processing of personal data related to the organization of support staff activities is regulated in more detail as referred to in Article 6, paragraph 2, among other things, in the law on the status and rights of social care clients and in the law on investigating the criminal background of volunteers working with children. The Administrative Court further states that the primary procedure for finding out the background of volunteer support persons working with children is the procedure in accordance with the Act on investigating the criminal background of volunteers working with children, in which the organizer of the volunteer activity can request the criminal record of the person in question from the Legal Registry Center. Based on its precedents, the aforementioned law is also applied to volunteer support staff working in the municipality's child protection (HE 149/2013 vp, detailed justification of § 3). According to Section 5 of the Act on investigating the criminal background of volunteers working with children, a criminal record extract can be requested from the Legal Records Center with the volunteer's prior written consent. However, the criminal record extract only shows the person's convictions at the time the extract is requested. The law does not provide for the investigation of other criminal information. On the basis of Section 20 of the Act on the Status and Rights of Social Care Clients, the social care authority has the opportunity to obtain necessary information that is essentially related to the social care client relationship. Based on this, the social authority can obtain confidential personal information in a single situation where the information in question is deemed necessary. The Administrative Court considers that, based on the wording of the legal section and its justification, the legal section is primarily intended to provide information about social care clients. In the decision under appeal, only the fact that the city of Helsinki has regularly requested information from the police about persons applying to be support staff under the mentioned legal section has been addressed. In the matter, no position has been taken on whether it is at all possible, in individual cases, to hand over information deemed necessary also about persons applying to be support staff, based on the mentioned legal section. The Administrative Court states that data from the police's information systems, other than the criminal record extract, can in themselves be relevant on a case-by-case basis in terms of assessing the suitability of a person applying to be a support person and ensuring the safety of children. However, based on the report presented in the case, the city has not limited the information it requests or receives on the basis that it must be necessary or necessary for this purpose. According to the report received, based on § 20 of the Act on the Status and Rights of Social Care Clients, the City of Helsinki has regularly requested information from the police about the criminal records and punishment records of the applicant as a support person, using a form that does not specify the time or subject limits of which information the request applies to. In connection with the request for information, it has not been assessed which information is necessary or necessary due to the task stipulated in the City of Helsinki Act and to fulfill the stated purpose of the City of Helsinki, i.e. to ensure the safety of children. Consequently, due to the procedure it followed in requests for information, the city has also processed information that was not necessary or necessary for the stated purpose. In the case of the registered person, the city of Helsinki has received investigative reports from the police, in which the registered person is the interested party. An opportunity has been reserved for the registered person to discuss the investigation notices, but he was later informed that the matters mentioned in the notices are not relevant to working as a support person. In the case of the registered person, the personal data in question has therefore not been necessary or necessary for the authority to carry out the task set out in the law. Based on the above, the administrative court states that the City of Helsinki has processed the personal data of the persons applying to be support persons more widely than the legal basis for the processing (the Act on investigating the criminal background of volunteers working with children and § 20 of the Act on the status and rights of social care clients) allows. The processing must therefore be considered to have violated Article 6 of the Data Protection Regulation. Since the information referred to in Article 10 has also been in question, at least in part, the City of Helsinki must also be considered to have violated Article 10 when handling such information more widely than is allowed in national legislation. Therefore, the deputy data protection commissioner has been able, as far as it is now a matter, to give the data controller a notice according to Article 58, paragraph 2, subparagraph b of the data protection regulation, and an order according to subparagraph d, to bring personal data processing activities into compliance with the provisions of the data protection regulation, so that personal data is no longer processed in violation of articles 6 and 10. Applied legal guidelines • The and • Act on the status and rights of social care clients Section 2 and Section 3 • Section 14 and Section 28 of the Social Welfare Act • Section 36 of the Child Protection Act Administrative law judge * voting statement I revoke the decision of the Deputy Data Protection Commissioner. Regarding jurisdiction and legal basis, I agree with the majority. In other respects, I state the following: The primary procedure for finding out the background of volunteer support persons working with children is the procedure according to the Act on investigating the criminal background of volunteers working with children, in which the organizer of the volunteer activity can request the criminal record of the person in question from the Legal Registration Center. However, the criminal record extract only shows the person's convictions at the time the extract is requested. The fact that the law does not expressly provide for criminal information other than the criminal record extract, in my opinion, the possibility given to the social welfare authority to obtain essential information essentially related to the social welfare client relationship based on Section 20 subsection 1 of the Act on the Status and Rights of Social Welfare Clients cannot be excluded. Based on this, the social authority can obtain confidential personal information from a person other than the client himself in a situation where the information in question is deemed necessary to assess the suitability of the client relationship, i.e. in this case the support person, for children in need of special support and in a vulnerable position, who are clients of child protection due to the risk of their growing conditions or behavior that endangers their own health and development. due to. The registrar has adopted a procedure where, based on Section 20, subsection 1 of the Act on the Status and Rights of Social Care Clients, with the consent of the person aspiring to be a child's support person, he has requested information from the police about the person's possible criminal record and punishment. The fact that the police have provided the city of Helsinki with information about the person other than what was requested, such as information about the person concerned, is not decisive, because the city has announced that it will not use this information. I believe that the city of Helsinki has sufficiently limited the information it requests and that the time and subject limitations of the criminal and punishment records do not provide enough information to ensure the suitability of the person and the safety of the children. The information requested about the possible criminal and penal records of the person aspiring to be a support person has thus been necessary or necessary for the purpose of the authority to carry out the task set out in the law. Since the City of Helsinki has not requested information more widely than is allowed in national legislation, it has not violated Articles 6 and 10 of the Data Protection Regulation. Thus, the deputy data protection commissioner has not been able to issue a notice to the controller in accordance with Article 58, paragraph 2, subparagraph b of the data protection regulation, nor an order in accordance with subparagraph d to bring personal data processing operations into compliance with the provisions of the data protection regulation. I therefore set aside the decision under appeal. As collateral *"
