Finnish SA imposed an administrative fine on collection agency for not responding to requests to exercise the data subjects rights

Background information

• Date of final decision: 13 December 2022
• National case
• Controller: Alektum Oy
• Legal Reference: Right of access (Article 15), Transparency, Providing information on action taken on a request under Article 15 (Article 12(3))
• Decision: administrative fine, reprimand
• Key words: access request

Summary of the Decision

Origin of the case

The Finnish SA began an investigation on the collection agency Alektum Oy after having received three complaints from private individuals. Two of the complaints said that the company had not replied to requests to access the data subjects’ data. One of the complainants had received a reply from Alektum but had still not been given the requested copy of their personal data.

Key Findings

The Finnish SA’s investigation revealed that Alektum Oy had regularly failed to reply to requests concerning the data protection rights of the data subject. The Finnish SA finds that the company was not sufficiently familiar with the requirements of data protection legislation and its operations indicated indifference regarding the law.

The company also obstructed and delayed the investigation by avoiding the supervisory authority. The SA made a variety of attempts to hear Alektum Oy during the investigation. The SA finds that the company was unwilling to explain its conduct or cooperate with the SA.

Decision

The Finnish SA imposed an administrative fine of EUR 750,000 on Alektum Oy for serious data protection violations. The company was also reprimanded.

For further information:

• Finnish national decision
• Press release on the Finnish SA’s website: Administrative fine imposed on collection agency for serious data protection violations – company did not respond to private citizens' requests to access their data (11 January 2023)