FinlandGDPR Articles 82-83 and Data Protection Act Section 24, Enforcement in Finland
Regulation (EU) 2016/679, Arts. 82-83; Tietosuojalaki 1050/2018 sec. 24
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Tietosuojalaki Section 26 provides that punishment for a data protection offence (tietosuojarikos) is set out in Criminal Code (rikoslaki) Chapter 38, Section 9: a controller or processor who intentionally or through gross negligence obtains personal data incompatibly with its purpose, or discloses or transfers personal data in violation of the GDPR, the Tietosuojalaki, the law on processing personal data in criminal matters (1054/2018), or another data protection law's purpose-limitation, disclosure or transfer rules, thereby violating the data subject's right to privacy or causing them damage or material harm, is sentenced to a fine or imprisonment of at most one year; the same offence covers a violation of those laws' data security requirements. Section 26 separately cross-references Criminal Code offences for violating communications secrecy, unlawful computer intrusion, and breach of the Tietosuojalaki's own confidentiality duties (Sections 35 to 36).
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine (seuraamusmaksu) tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher; Article 83(4) sets the narrower EUR 10,000,000 or 2 percent tier for the Article 25 to 39 obligations. Tietosuojalaki (1050/2018) Section 24 makes this fine available in Finland but expressly exempts the entire public sector from it: state authorities, state enterprises, municipal authorities, independent public-law institutions, parliamentary agencies, the Office of the President of the Republic, and the Evangelical Lutheran and Finnish Orthodox Churches and their parishes cannot be fined under this provision at all, leaving a private-sector-only fine regime. The fine is decided by a collegial body of the Data Protection Ombudsman and the Deputy Data Protection Ombudsmen, with a quorum of three, rather than by the Ombudsman alone, and may not be imposed more than ten years after the violation occurred (or, for a continuing violation, after it ended).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland's supervisory authority. Under Tietosuojalaki Section 24, the administrative fine specifically (as opposed to the Ombudsman's other corrective powers) is decided by a collegial body of the Ombudsman and the Deputy Ombudsmen (quorum of three) rather than by the Data Protection Ombudsman personally.
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Finnish rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 82 gives a right to compensation and Article 83 sets the conditions for administrative fines; Section 24 of the Data Protection Act assigns the fine to a collegial body of the Ombudsman and Deputy Ombudsmen. None states a duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation.
- Kind
- None
- As of
What this law does
The Data Protection Ombudsman is Finland's supervisory authority. Section 24 assigns a General Data Protection Regulation (GDPR) Article 83 administrative fine to a collegial Sanctions Board chaired by the Ombudsman with at least two Deputy Ombudsmen and a three-member quorum, carries a ten-year limitation period from the infringement, and bars a fine against central government authorities, municipal authorities, and several other named public bodies.
GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor, and court proceedings to claim it are brought before the courts competent under Finnish law.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .