Two decisions of the Supreme Administrative Court of Finland (Korkein hallinto-oikeus) have arisen regarding fines by administrative bodies on data controllers under the General Data Protection Regulation (GDPR).
In the first case, Case KHO:2023:81, the national postal service (Posti Oy) was initially fined, administratively, €100,000 by the Data Protection Ombudsman of Finland (Tietosuojavaltuutetun toimisto) for privacy breaches. It had, in the Data Protection Ombudsman’s view, failed to provide to data subjects the active measures that were necessary in order to protect personal data that should not have been disclosed.
The postal service appealed the administrative decision to the national courts. At first instance before the Administrative Court of Helsinki, the fine was overturned. However, the case before the Supreme Administrative Court of Finland overturned the first instance decision, and upheld the original administrative decision, imposing the €100,000 fine.
In the second case, Case KHO:2023:82, concerned a company’s way of processing job applicants’ personal data. Here, the Supreme Administrative Court upheld the original decision of the Administrative Court of Turku, which had overturned the Data Protection Ombudsman’s administrative fine of €12,500.
This was because, in its view, it is for the Data Protection Ombudsman’s to carry out its own investigation into alleged breaches of GDPR, and not rely upon a presumption of guilt upon a company which is alleged to have had irregularities in this regard.
In both cases, parties before the court asked for references for a preliminary ruling to be made on the interpretation of various provisions of GDPR. In both cases, the Supreme Administrative Court refused to do so. It is worth noting that a national court in Denmark has recently made a reference for a preliminary ruling to the Court of Justice over fines and GDPR, albeit on different articles.
More information on Case KHO:2023:81 can be accessed here, and on Case KHO:2023:82 here.