FINNISH DPA IMPOSES FINANCIAL SANCTION
The sanctions board of the Office of the Data Protection Ombudsman (“DPA”) imposed a financial sanction of EUR 7,000 on a company due to carrying out electronic direct marketing without prior consent as well as neglecting the rights of the data subject.
During the spring and summer of 2019, the Office of the Data Protection Ombudsman received eleven complaints on the electronic direct marketing of the company and the company neglecting the rights of the data subject in accordance with the General Data Protection Regulation (“GDPR”). In the complaints, the data subjects reported that they had received direct marketing messages from the company without consenting to it. Some of the data subjects have responded to the marketing message sent as an SMS as requested by the controller in order to prohibit direct marketing. Despite the prohibition, the data subjects have still received direct marketing messages from the controller. Therefore, the controller has failed to implement the data subjects’ right to object in accordance with the GDPR.
In addition, in some of the complaints, the data subjects had made requests concerning their rights in accordance with the GDPR. However, the controller did not respond to the requests without undue delay and within one month of receiving the request at maximum, as required by the GDPR. The controller has not implemented any requests related to these rights, either.
According to the Deputy Data Protection Ombudsman, the controller does not seem to have organised its operating methods in processing personal data in such a way that the controller would be able to tell if it has implemented the rights of the data subjects or received requests related to the rights. The Deputy Data Protection Ombudsman states that as a result, the controller was not able to prove that it had processed personal data legally.
The Deputy Data Protection Ombudsman gave the company a reprimand for neglecting the rights of the data subject and failing to implement them. The Deputy Data Protection Ombudsman also ordered the company to change its operating methods and implement the rights of the data subject in accordance with the GDPR.
The decisions of the Deputy Data Protection Ombudsman and sanctions board are not yet final and are open to appeal in the administrative court.
You can reach the press release text of the decision here.
Should you have any queries and/or remarks, please do not hesitate to contact us.