KHO - KHO:2025:51
From GDPRhub
| KHO - KHO:2025:51 | |
|---|---|
 | |
| Court: | KHO (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 15(1) GDPR |
| Decided: | 11.06.2025 |
| Published: | |
| Parties: | |
| National Case Number/Name: | KHO:2025:51 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Finnish |
| Original Source: | KHO (in Finnish) |
| Initial Contributor: | Le |
The Supreme Administrative Court held that the response to an access request regarding log data can be limited to information about the dates data was accessed rather than the exact time. The court deemed this information sufficient for a data subject to assess the lawfulness of the processing of their data.
English Summary
Facts
A data subject made an access request to a bank (controller) regarding log data concerning him and in particular the identity of the employees who processed his customer data between 1 November and 31 December 2013, the purpose of the processing and the dates on which the data were accessed.
The data subject filed a complaint with the DPA requesting access to this data.
In August 2020, the DPA dismissed his complaint stating that no order for access to the data will be issued because the log data in question do not constitute data concerning the data subject but they relate specifically to the employees who have processed the customer data.
The data subject appealed this decision to the court of first instance (Administrative Court of Eastern Finland).
In September 2021, the court of first instance requested a preliminary ruling from the CJEU asking if the right of access of the data subject under Article 15(1) GDPR is to be interpreted so that it includes information collected by the controller which shows who, when and for what purpose he has processed the data subject's personal data, in particular when it concerns data relating to the controller's employees.
In June 2023 the CJEU (Case C-579/21) held, inter alia, that Article 15(1) GDDPR must be interpreted as meaning that the information relating to the times and purposes of the searching of a person's personal data constitutes information that a data subject is entitled to obtain from the controller under that provision. By contrast, that provision does not establish such a right to information concerning the identity of the employees of the controller who have carried out the searches under the authority and on the instructions of the controller, except where that information is necessary to enable the data subject to exercise effectively the rights conferred on him by the GDPR and provided that the rights and freedoms of those employees are respected.
The court of first instance concluded that the data subject is entitled to be informed of the time of processing of his data to the extent that they appear in the user logs but not of the identity of the bank employees who carried out the processing.
The controller appealed this decision before the Supreme Administrative Court (Korkein Hallinto-Oikeus - KHO) claiming that the data subject is not entitled to be informed of the exact time of the processing of his personal data to the extent that they are indicated in the controller’s user logs, but it is sufficient to be informed of the dates of the processing, since this would not make any difference in his ability to exercise his rights under the GDPR.
Holding
The court annulled the decision of the court of first instance in respect on the decision on the time of the day of the processing operations.
The court highlighted that the purpose of Article 15(1) GDPR is to ensure transparency of the processing of the personal data, without which the data subject would not be able to assess the lawfulness of the processing of their data and to exercise their rights laid down in the GDPR. The precision with which a data subject is entitled to be informed of the timing of processing activities concerning his personal data must be assessed in the light of the aforementioned purpose.
The court concludes that the data subject is only entitled to receive information regarding the dates on which his data had been accessed even if the time of the day is indicated in the log files. This information is sufficient to assess the lawfulness of the processing of his data and fully exercise his rights under the GDPR.
Finally, the court referred the case back to the DPA to issue a decision in this regard.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
The case concerned whether, under the General Data Protection Regulation, an individual had the right to obtain information on the exact times of queries made to his customer data by a bank. The times of the queries were reflected in the bank's user log data both as dates and as exact times. According to the judgment of the Court of Justice in the case in question, information on the times of query actions relating to queries made to a person's personal data is information which the person concerned has the right to obtain from the controller under Article 15(1) of the General Data Protection Regulation. The provision aims to ensure, in part, the transparency of the procedures for processing personal data vis-à-vis the data subject, without which he would not be able to assess the lawfulness of the processing of his data and exercise his rights under the Regulation. The Supreme Administrative Court held, on the grounds set out in its decision, that it was not possible to conclude from the judgment of the Court of Justice that an individual would have the right to receive information on the times of processing of their personal data, with the exact time, on the basis of Article 15 of the General Data Protection Regulation, even if the times are reflected in the log data. Taking into account the explanation that the bank had already given the individual about the processing of their personal data, the Supreme Administrative Court held that an individual can assess the lawfulness of the processing of their data and exercise their rights under the General Data Protection Regulation to the full extent when, in addition to the information they have already received, they receive information contained in the log data on the dates on which queries were made to their customer data by the bank. Judgment of the Court of Justice in Case C-579/21, Bank S (ECLI:EU:C:2023:501) Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Article 12(1) and Article 15(1) Decision subject to appeal Court of Eastern Finland No 2891/2023 of 22 December 2023 Judgment of the Supreme Administrative Court 1. A's application for leave to appeal is dismissed. The Supreme Administrative Court therefore does not rule on his appeal. 2. Bank S's application for leave to appeal is dismissed in so far as the purposes of the processing of personal data are concerned. The Supreme Administrative Court therefore does not rule on Bank S's appeal in this respect. 3. The Supreme Administrative Court grants Bank S leave to appeal insofar as the matter concerns the timing of the processing of personal data and examines the matter in this respect. The decision of the Administrative Court of Eastern Finland is quashed insofar as the decision concerning the timing of the processing of personal data is concerned and the matter is returned to the Deputy Data Protection Commissioner for reconsideration in this respect. The Deputy Data Protection Commissioner shall issue an order to Bank S pursuant to Article 58(2)(c) of the General Data Protection Regulation to provide A with information on the timing of the processing of his personal data, with the accuracy of the dates. Background to the matter (1) The Deputy Data Protection Commissioner has, by decision of 4 August 2020, decided on A’s request for action to gain access to Bank S’s data, which reveals the identity of the persons who processed A’s customer data at the bank between 1 November and 31 December 2013, the purpose of the processing and the dates of the data review. The Deputy Data Protection Commissioner has stated in his decision that no order on the right to access the data shall be issued. (2) The reasons for the decision state that the request for action actually corresponds to a request for access to user log data. According to the reasons, when applying the General Data Protection Regulation, log data must be considered to be data specifically concerning employees who have processed customer data. Therefore, the log data in question are not data concerning A to which he would have the right to access under Article 15 of the General Data Protection Regulation. (3) Following A’s appeal against the decision of the Deputy Data Protection Commissioner to the Administrative Court of Eastern Finland, the Administrative Court has, by its interim decision of 21 September 2021, decided to request a preliminary ruling from the Court of Justice of the European Union on, among other things, the following questions: 1. Should the data subject’s right of access under Article 15(1) of the General Data Protection Regulation be interpreted in conjunction with the concept of personal data under Article 4(1) of the Regulation in such a way that the data collected by the controller, which show who has processed the data subject’s personal data, when and for what purpose, is not data to which the data subject has the right to access, in particular because it concerns data concerning the data subject’s employees? 2. If the answer to question 1 is yes and the data subject does not have the right to access the data referred to in the question under Article 15(1) of the GDPR, because they are not to be considered as personal data of the data subject under Article 4(1) of the GDPR, the question then arises as to the information to which the data subject is entitled under Article 15(1)(a) to (h): a) How is the purpose of the processing under Article 15(1)(a) to be interpreted in terms of the scope of the data subject’s right of inspection, i.e. can the purpose of the processing be based on the right of inspection on the user log data collected by the controller, such as the personal data of those who processed the data subject’s personal data, when the personal data were processed and for what purpose? (4) In its judgment of 22 June 2023, following a request for a preliminary ruling from the Administrative Court, in Case C-579/21, the Court of Justice held, inter alia, that Article 15(1) of the General Data Protection Regulation must be interpreted as meaning that information relating to the times and purposes of the searches carried out on a person’s personal data constitutes information which that person is entitled to obtain from the controller under that provision. However, that provision does not establish such a right to information concerning the identity of the controller’s employees who carried out the searches under the controller’s authority and on its instructions, unless that information is necessary for the effective exercise of the rights conferred on the data subject by that regulation and provided that the rights and freedoms of those employees are taken into account (paragraph 2 of the operative part and point 83 of the grounds). (5) The Administrative Court of Eastern Finland has, by its decision of 22 December 2023, overturned the decision of the Deputy Data Protection Commissioner and returned the matter to the Commissioner for re-examination. The Deputy Data Protection Commissioner shall issue an order reflecting the conclusions of the decision after the decision of the Administrative Court has become final. (6) The conclusions of the reasoning of the decision of the Administrative Court have stated, among other things, that the matter shall be returned to the Deputy Data Protection Commissioner for the purpose of issuing an order pursuant to Article 58(2)(c) of the General Data Protection Regulation to Bank S. A has the right to obtain information about the times when the complainant's personal data was processed to the extent that they appear in Bank S's user log data. However, A does not have the right to obtain information about the identity of the bank's employees who carried out the processing. (7) The grounds for the decision also held, inter alia, that A's right to information about the purposes of the processing pursuant to Article 15(1)(a) of the General Data Protection Regulation has not been violated. The case was decided by the members of the Administrative Court, Timo Tervonen, Heli Mäki-Rautila and Olli Rautsi (partly dissenting). Claims and explanations in the Supreme Administrative Court (8) A must be deemed to have requested permission to appeal the decision of the Administrative Court insofar as it concerns the identities of the processors of personal data and the purposes of the processing. (9) Bank S has requested permission to appeal the decision of the Administrative Court insofar as it concerns the times of the personal data processing activities and the purposes of the processing. In its appeal, Bank S has requested that the administrative court’s decision be amended and confirmed that A does not have the right to receive information on the times of processing of his personal data with the precision that appears in Bank S’s user log data, but that it is sufficient that information is provided on the dates of processing. Even if the time information were provided to A with more precise details than the daily level, this would not increase his ability to exercise his rights under the GDPR. Providing log data could also reveal sensitive information from the point of view of information security about what is and is not logged in the organisation and with what precision. Bank S has also requested that it be confirmed that the information provided by the bank to A on the purposes of processing of personal data has exceeded that required by Article 15(1)(a) of the GDPR. (10) In his statement issued in response to Bank S’s application for leave to appeal and the appeal, the Deputy Data Protection Ombudsman has submitted that Bank S be granted leave to appeal insofar as the administrative court’s decision concerns the dates of the processing of personal data. The Deputy Data Protection Ombudsman has considered that, in order to ensure the fulfilment of A’s rights and freedoms, it is sufficient for Bank S to provide him with the dates on which his personal data were processed by the bank during the period he requested. (11) In his statement issued in response to Bank S’s application for leave to appeal and the appeal and the statement issued by the Deputy Data Protection Ombudsman, A has stated, among other things, that Bank S must provide the information from the bank’s user log on the dates on which A’s personal data was processed. According to the judgment of the Court of Justice in Case C-579/21, the log information must be provided as it is, so that it shows the frequency and intensity of the queries. Reasons for the Supreme Administrative Court’s decision 1. Rejection of A’s application for leave to appeal (12) According to Section 111(1) of the Act on Judicial Procedure in Administrative Matters, leave to appeal must be granted if: 1) it is important for the application of the law in other similar cases or for the sake of uniformity of case law to refer the matter to the Supreme Administrative Court for decision; 2) there is a special reason for referring the matter to the Supreme Administrative Court for decision due to an obvious error in the matter; or 3) there is another weighty reason for granting leave to appeal. (13) Based on what A has submitted and what otherwise appears from the documents, there is no basis for granting leave to appeal to the Supreme Administrative Court for adjudication. 2. Partial rejection of Bank S's application for leave to appeal (14) Based on what Bank S has submitted and what otherwise appears from the documents, there is no basis for granting leave to appeal as referred to in section 111(1) of the Act on Administrative Proceedings insofar as the purpose of the processing of personal data is at issue in the case. 3. Partial annulment of the Administrative Court's decision and remand of the case to the Deputy Data Protection Commissioner for re-examination Question (15) The case concerns whether A has the right to obtain information on the exact times of the queries made to his customer data by Bank S. This question will be assessed in the light of the provisions of the General Data Protection Regulation and the judgment of the Court of Justice in Case C-579/21. (16) The Administrative Court has held that A has the right to be informed of the times when his personal data were processed with the same precision as they appear in the user log data of Bank S, i.e. with the precision of the time. The controller, Bank S, has submitted that it is sufficient for A to be informed of the dates when his personal data were processed. (17) The case does not assess whether the processing of A's personal data by Bank S was lawful. Legal guidelines (18) According to Article 12(1) of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC), the controller shall take appropriate steps to provide the data subject with the information referred to in Articles 13 and 14 and with any information concerning the processing referred to in Articles 15 to 22 and Article 34 in a concise, transparent, easily intelligible and accessible form, in clear and plain language, in particular where the information is addressed specifically to a child. The information shall be provided in writing or by any other means, and, where appropriate, by electronic means. (---). (19) According to Article 15(1) of the GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where such data are being processed, access to the personal data and the following information: (a) the purposes of the processing; (---). (20) According to Recital 63 of the GDPR, the data subject should have the right to access personal data concerning him or her and to exercise that right easily and at reasonable intervals, in order to ascertain and verify the lawfulness of the processing. (---). All data subjects should therefore have the right to know and be informed, in particular, of the purposes for which personal data are processed and, where possible, of the duration of the processing, of the recipients of the personal data, of the logic involved in the automated processing of personal data and of the possible consequences of such processing, at least where the processing is based on profiling. (---). This right should not adversely affect the rights and freedoms of others, such as trade secrets or intellectual property, in particular copyright in software. However, taking these factors into account should not lead to the data subject not being given any information. (---). Legal assessment and conclusion (21) According to the judgment of the Court of Justice in Case C-579/21, Article 15(1) of the GDPR must be interpreted as meaning that information relating to queries made to personal data concerning a person at the time of the query constitutes information which the person concerned is entitled to obtain from the controller under that provision (paragraph 83). (22) The judgment refers to Article 15(1) of the General Data Protection Regulation as one of the provisions aimed at ensuring transparency of the procedures for processing personal data vis-à-vis the data subject, without which he would not be able to assess the lawfulness of the processing of his data and exercise, inter alia, the rights provided for in Articles 16 to 18, 21, 79 and 82 of the Regulation (paragraph 59). The Supreme Administrative Court states that the question of the level of precision with which a person is entitled to obtain information on the dates of queries concerning his personal data must be assessed in the light of the above-mentioned purpose of Article 15(1) of the General Data Protection Regulation. (23) The dates of the queries made by Bank S concerning A’s personal data are apparent from the bank’s user logs. The judgment of the Court of Justice has held that the log files containing the information requested by A constitute records of processing operations within the meaning of Article 30 of the General Data Protection Regulation. They must be considered to be part of the measures taken by the controller to demonstrate that the processing operations comply with the Regulation, as referred to in recital 74 of the Regulation. Article 30(4) of the Regulation specifies in particular that they must be made available to the supervisory authority upon request (paragraph 67). (24) The judgment further states that, in the case of the controller’s user logs in particular, the provision of a copy of the data contained therein may prove necessary in order to fulfil the obligation to grant the data subject access to all the data referred to in Article 15(1) of the GDPR and to ensure fair and transparent processing in such a way that the data subject is able to fully exercise his rights under that Regulation (paragraph 69). The judgment further states that the user logs reveal that data have been processed, which is information to which the data subject must have a right of access under Article 15(1) of the GDPR. They also provide information on the frequency and intensity of the queries, thus enabling the data subject to ascertain whether the processing carried out was indeed justified in accordance with the purposes stated by the controller (paragraph 70). The Supreme Administrative Court states that the above-mentioned factors must be taken into account when assessing the level of accuracy with which a person has the right to obtain information about the times of queries concerning his or her personal data. (25) The user log data shows that queries were made to A’s customer data at Bank S on several different days between 1 November and 31 December 2013. According to the report provided by Bank S to A on 30 August 2018, A’s data was processed by four members of the bank’s staff. The report further states that the processing of A’s data was related to the processing of another customer’s case, to which A was found to have been involved when processing the case. Another customer's information has revealed that a person named A had a debt relationship with the customer. Since A was at the same time the customer's account manager, the bank has had to investigate whether A was the debtor in question and whether there could have been a possible inappropriate conflict of interest in that case. The investigation has also required processing A's information. Every member of the bank's staff who processed A's information has provided the bank group's internal audit with a statement on the reasons for processing A's information. The report also states that the internal audit auditor has issued a statement based on the report, according to which "the report did not identify any inquiries into account and customer information that were not related to a service transaction or other appropriate task". (26) The dates of the inquiries made to A's customer information at Bank S are reflected in the bank's user log data, both as dates and as exact times. (27) In the judgment of the Court of Justice in Case C-579/21, it was stated that it is apparent from the request for a preliminary ruling that A had requested the bank to provide information on the dates of the queries concerning his personal data between 1 November 2013 and 31 December 2013 (paragraph 60). In view of this and considering the reasoning of the judgment as a whole, the Supreme Administrative Court considers that it cannot be concluded from the judgment that A has the right, on the basis of Article 15 of the General Data Protection Regulation, to obtain information on the times when his personal data were processed, with the exact time of day, even though the times are reflected in the log data. (28) In view of the explanation that Bank S has already given to A regarding the processing of his personal data, the Supreme Administrative Court considers that A can assess the lawfulness of the processing of his data and exercise his rights under the General Data Protection Regulation to the full extent when he receives, in addition to the information he has already received, the information contained in the log files on the dates on which his customer data were accessed by Bank S. (29) The Supreme Administrative Court also states that if a data subject considers that the processing of personal data concerning him infringes the General Data Protection Regulation, the data subject has the right to refer the matter to the Data Protection Commissioner pursuant to Article 77(1) of the said Regulation and Section 21 of the Data Protection Act. The Data Protection Commissioner has the power, pursuant to Article 58(1)(a) of the said Regulation, to order the controller to provide the Data Protection Commissioner with all the information that the Commissioner needs to investigate the matter. (30) In view of the above, the decision of the Administrative Court must be annulled in so far as it concerns the decision on the dates of the processing operations and the matter must be remitted to the Deputy Data Protection Commissioner for reconsideration. The Deputy Data Protection Commissioner must issue an order to Bank S pursuant to Article 58(2)(c) of the General Data Protection Regulation to provide A with information on the dates of the processing of his personal data, with the accuracy of the dates. The case has been decided by legal advisors Outi Suviranta, Petri Helander, Taina Pyysaari, Toni Kaarresalo and Robert Utter. The rapporteur for the case is Mikko Rautamaa.
