- Date of final decision: 13 December 2022
- National case
- Controller: Alektum Oy
- Legal Reference: Right of access (Article 15), Transparency, Providing information on action taken on a request under Article 15 (Article 12(3))
- Decision: administrative fine, reprimand
- Key words: access request
Summary of the Decision
Origin of the case
The Finnish SA began an investigation on the collection agency Alektum Oy after having received three complaints from private individuals. Two of the complaints said that the company had not replied to requests to access the data subjects’ data. One of the complainants had received a reply from Alektum but had still not been given the requested copy of their personal data.
The Finnish SA’s investigation revealed that Alektum Oy had regularly failed to reply to requests concerning the data protection rights of the data subject. The Finnish SA finds that the company was not sufficiently familiar with the requirements of data protection legislation and its operations indicated indifference regarding the law.
The company also obstructed and delayed the investigation by avoiding the supervisory authority. The SA made a variety of attempts to hear Alektum Oy during the investigation. The SA finds that the company was unwilling to explain its conduct or cooperate with the SA.
The Finnish SA imposed an administrative fine of EUR 750,000 on Alektum Oy for serious data protection violations. The company was also reprimanded.
For further information:
- Finnish national decision
- Press release on the Finnish SA’s website: Administrative fine imposed on collection agency for serious data protection violations – company did not respond to private citizens' requests to access their data (11 January 2023)
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.