Tietosuojavaltuutetun toimisto (Finland) - TSV/112/2022 (9079/152/22)
From GDPRhub
| Tietosuojavaltuutetun toimisto - TSV/112/2022 (9079/152/22) | |
|---|---|
 | |
| Authority: | Tietosuojavaltuutetun toimisto (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 5(1)(c) GDPR Article 12(2) GDPR Article 12(6) GDPR Article 15(1) GDPR Article 15(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 11.11.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | TSV/112/2022 (9079/152/22) |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Finnish |
| Original Source: | Finlex (in FI) |
| Initial Contributor: | n/a |
The DPA issued a warning to the controller for violating Articles 5(1)(c), 15(1) and (3) and 12(2) and (6) GDPR by failing to provide access to the data subject’s personal data and by requiring unnecessary additional information for access.
English Summary
Facts
On 13 October 2022, the data subject requested access to data concerning them held by Company A by email pursuant to Article 15(1). On 19 October 2022, Company A responded but it did not provide the requested information. Company A required the data subject to fill in a form on its website.
On 31 October 2022, the data subject again requested access to the data by email. On 14 November 2022 the controller answered by again requiring the data subject to fill in the form on the website. According to the data subject, the form requested information such as their personal identification number. The controller argued that this is necessary in order to identify the data subject.
Holding
The DPA found that the controller violated Article 15(1) and Article 15(3) GDPR by failing to implement the data subject’s right of access. It also held that the controller violated Article 12(2) and Article 12(6) GDPR by not facilitating the exercise of that right and by requesting more information than necessary.
The DPA found that the controller failed to assess whether it could identify the data subject based on the information already provided and instead required routine collection of additional information. Therefore, this requirement did not facilitate the exercise of the right of access under Article 12(2).
Under Article 12(6) GDPR, additional information may only be requested where there are reasonable doubts about the identity. The DPA considered that the controller failed to demonstrate such doubts. Hence, the personal identity number constituted unnecessary additional information and its request violated Article 12(6) GDPR. The DPA further held that the controller infringed the data minimisation principle under Article 5(1)(c). By requiring the personal identification number as part of a routine identification practice, although it did not previously process that data and could identify the data subject based on the information already provided, the controller requested more personal data than necessary for identification.
The DPA found the data subject's access request by email valid and thus the controller failed to provide access to the data subject's personal data in violation of Article 15(1) and Article 15(3). The DPA issued a warning to the controller for failure to exercise the rights of the data subject and ordered the controller to comply with the data subject’s request pursuant to Article 15 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
The data subject has initiated a case with the Office of the Data Protection Ombudsman concerning the data subject's right of access to information pursuant to Article 15 of the General Data Protection Regulation ((EU) 2016/679) of the European Parliament and of the Council (hereinafter also the right of access). The data subject has wanted to access information held by company A concerning him/her. The data subject states that he/she submitted a request for access to company A on 13 October 2022. The data subject has sent the request to company A by email. According to the correspondence submitted by the data subject in the case, company A has responded to the request on 19 October 2022, but has not provided the requested information. According to the data subject, company A has refused to provide the information by email or letter and has required the data subject to fill in a specific form on the website in order to exercise his/her right so that the data subject can be identified. The form requested information such as personal identification number, according to the data subject. Statement received from the controller Based on public information sources available to the Office of the Data Protection Commissioner, company A has since merged with company B [date deleted]. Following the merger, the controller in the matter is company B. Company B has been requested to provide information on 26.5.2023. The controller has responded to the request for information on 26.6.2023. According to the controller, the data subject has again requested access to the information on 31.10.2022 via a relevant email. The controller has stated that it has responded to the request on 14.11.2022, again requiring the data subject to fill out a form on the website, which is intended to implement the requests of data subjects. The controller has considered that the controller has not refused to implement the data subject's request for access to the data. According to the controller, the data subject has instead been instructed on how data subjects can exercise their right under the General Data Protection Regulation. The controller states in its report that the data subject has been asked to fill in a form so that the data subject's identity can be confirmed. According to the controller, all data subjects are required to fill in a form on the controller's website in order to exercise their right under the General Data Protection Regulation. According to the report submitted by the controller, the controller does not currently process the personal identification number of data subjects, and the personal identification number has only been processed in connection with the form to the extent that it was required to identify the data subject. According to the controller's report, the personal identification number query that was included in the form sent to the data subject on 19 October 2022 and 14 November 2022 has been removed from the form currently used by the controller. The controller has stated that the online form has been implemented in cooperation with the service provider. According to the controller, the form currently in use requires, in addition to the data subject's full name, strong identification using, for example, bank codes or a mobile certificate. Response of the data subject No response has been requested from the data subject in the matter. The matter is so clear based on the applicable legislation and established interpretation practice that a solution can be given without a response from the data subject based on Section 34, Subsection 2, Paragraph 5 of the Administrative Procedure Act. The matter can be resolved based on the applicable legislation and the requirement brought to the attention of the Office of the Data Protection Ombudsman and the response of the data subject. Applicable law The General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) applies. The regulation is directly applicable in the Member States. The General Data Protection Regulation is further specified in the Data Protection Act (1050/2018). Pursuant to Article 15 of the GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where such personal data are being processed, the right to access the personal data and to obtain the information referred to in points (a) to (h) of Article 15(1). Pursuant to Article 3 of the same Article, the controller shall provide a copy of the personal data processed. Pursuant to Article 12(2) of the GDPR, the controller shall facilitate the exercise of the data subject’s rights under Articles 15 to 22. According to Article 12(6) of the GDPR, where the controller has reasonable grounds to doubt the identity of a natural person who has made a request pursuant to Articles 15 to 21, the controller may, without prejudice to Article 11, request the provision of additional information necessary to verify the identity of the data subject. According to Article 5(1)(c) of the GDPR, personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’). According to Article 58(2)(b) of the GDPR, the supervisory authority may issue a warning to the controller or processor where the processing operations have infringed the provisions of this Regulation. According to Article 58(2)(c) of the GDPR, the supervisory authority may order the controller or processor to comply with the data subject’s requests concerning the exercise of the data subject’s rights under the GDPR. Legal issue The Deputy Data Protection Supervisor shall assess and decide on the matter as mentioned above on the basis of the General Data Protection Regulation (EU) 2016/679. The Deputy Data Protection Supervisor shall decide on the matter whether the controller has complied with the obligation under Article 15(1) and (3) of the GDPR to grant the data subject the right to access data concerning him or her, and whether the controller’s procedures for identifying the data subject have been in accordance with Article 12(2) and (6) and Article 5(1)(c) of the GDPR. In addition, it shall be assessed whether the corrective powers provided for in Article 58 of the GDPR apply. The Deputy Data Protection Supervisor provides guidance on the current responsibility of the controller regarding the identification of the data subject. Decision and reasoning of the Deputy Data Protection Supervisor The Deputy Data Protection Supervisor considers that the controller has not implemented the controller's obligation under Article 15(1) and (3) of the General Data Protection Regulation to grant the data subject the right to access data concerning him or her. The Deputy Data Protection Supervisor considers that the controller's practice of requiring a personal identification number to identify the data subject has not been in accordance with Article 5(1)(c) and Article 12(2) and (6) of the General Data Protection Regulation. The controller's practice has made it difficult for the data subject to exercise his or her right, and the controller has requested unnecessary additional information from the data subject. Notice The Deputy Data Protection Supervisor issues a notice to the controller pursuant to Article 58(2)(b) of the GDPR for failure to implement the data subject's right. Order The Deputy Data Protection Supervisor issues an order to the controller pursuant to Article 58(2)(c) of the GDPR to comply with the data subject's request pursuant to Article 15 of the GDPR in accordance with Articles 12(2) and 15 of the GDPR, unless the controller has already implemented the data subject's right before issuing this decision. Justification The controller is obliged to verify the identity of the person making the request in order to ensure the appropriate protection of personal data and to minimise the risks of personal data being disclosed to third parties. According to Article 12(6) of the GDPR, where the controller has reasonable grounds to doubt the identity of the natural person making the request, the controller may request the data subject to provide additional information necessary to verify the identity of the data subject. While the controller is obliged to verify the identity of the data subject before exercising the data subject's right, Article 12(2) of the GDPR also requires the controller to make every effort to facilitate the exercise of the data subject's rights. Where the controller imposes conditions on the exercise of the data subject's right that require additional steps from the data subject, the controller should be able to duly justify the conditions imposed and take into account the principle of data minimisation as well as the rules governing the exercise of the data subject's rights. According to recital 64 of the General Data Protection Regulation, the controller should use all reasonable means to verify the identity of a data subject who wishes to access the data. The Deputy Data Protection Supervisor draws attention to the fact that the data subject has provided the controller with his/her name, email address and the relevant parking fee reminder number in his/her request made on 13 October 2022. In addition, the data subject has specified the name of the parking area and the time of parking subject to the fee in his/her message sent to the controller on 19 October 2022. The controller's report shows that the controller has not implemented the data subject's request and directed him/her to submit the request by filling out a form on the website due to the controller's identification policy. The controller has stated that all data subjects are required to complete a form on its website in order to submit a request for access. The form requires, among other things, the provision of a personal identification number. Based on the investigation received in the matter, the controller's request to provide a personal identification number was based on the controller's regular operating procedures. The controller must assess on a case-by-case basis whether it is able to identify the data subject who has requested the information on the basis of the information provided by the data subject. The controller cannot therefore routinely collect additional information from all data subjects who have made the request. The controller's ability to request additional information for the purpose of identifying the data subject cannot result in the collection of personal data that are not relevant or necessary to establish the link between the person and the requested personal data. The controller has not stated in its report that it has assessed its ability to identify the data subject on the basis of the information provided by the data subject. According to the Deputy Data Protection Commissioner, the controller's approach to requiring the submission of a form for identifying the data subject has not been based on a case-by-case assessment in the present case, but has been a normal and regular means of identification. The controller's approach has caused additional inconvenience to the data subject, considering that the data subject had already submitted his request by email. The controller's conduct can therefore be considered to have infringed Article 12(2) of the General Data Protection Regulation, as the requirement to use the form has not facilitated the exercise of the data subject's right. The methods of identifying the data subject should always be appropriate and proportionate to the personal data processed and the controller's field of activity and comply with the principle of data minimisation set out in Article 5(1)(c) of the General Data Protection Regulation. In accordance with the principle of data minimisation, the controller should not request more information from the data subject than is necessary to identify him or her. The key point in the assessment of the matter is what information the controller already has about the data subject. Based on the controller's explanation, the controller has not previously processed the personal identification number of the data subject. The Deputy Data Protection Commissioner considers that the controller has therefore sought to collect more information for identification than it originally had. The personal identification number of the data subject must therefore be considered in the present case as additional information pursuant to Article 12(6) which the controller should only request if it has reasonable grounds to doubt the identity of the data subject. The Deputy Data Protection Supervisor considers that the controller had at its disposal less intrusive means of ensuring that the data subject is not another data subject with the same name. The Deputy Data Protection Supervisor considers that the controller was able to identify the data subject on the basis of the name, e-mail address, parking fee reminder number, parking area for which the fee was charged and the time of parking. The Deputy Data Protection Supervisor points out that even if it were possible that the controller would have sent a parking fee with the same identifier to two data subjects with the same name at the same time and in the same parking area, it would always be possible for the controller to request from the data subject, in order to identify the data subject, information on the registration number of the parked vehicle or the address of the data subject to which the controller has sent the parking fee and the payment reminder. In his assessment, the Deputy Data Protection Supervisor has also taken into account that the case concerns parking fees and private law parking fees, which are in principle low-risk information and do not reveal sensitive information about the data subject. Based on the above, the Deputy Data Protection Supervisor considers that the controller has not implemented the data subject's right of access in accordance with Article 15(1) and (3) of the General Data Protection Regulation. The Deputy Data Protection Supervisor also considers that the controller has not facilitated the exercise of the data subject's right by requiring the data subject to provide information on his or her personal identification number. As described in the reasons for this decision, the controller has set conditions for the exercise of the data subject's right that are not to be considered in accordance with Article 12(2) and (6) of the General Data Protection Regulation. The Deputy Data Protection Supervisor further considers that the controller has required the data subject to provide more personal data than would have been necessary to identify the data subject, and has thus acted contrary to the principle of data minimisation set out in Article 5(1)(c) of the General Data Protection Regulation.
