On September 11, 2023, the Office of the Data Protection Ombudsman (the Ombudsman) published its Decision in Case No. 8422/161/2021, as issued on July 6, 2023, in which its Sanctions Board imposed a fine of €23,000 on Suomen Yritysrekisteri Oy for violations of the General Data Protection Regulation (GDPR), following several complaints.

Background to the decision

In particular, the Ombudsman noted that it had investigated Suomen Yritysrekisteri's management of the Finnish Business Register and that several complaints were submitted by companies against Suomen Yritysrekisteri. In particular, these companies alleged that they had received an invoice after a sales call about the Finnish Business Register, based on which they requested a recording of the call to Suomen Yritysrekisteri, and that, while Suomen Yritysrekisteri provided them with a written summary of the call, it did not disclose the recording of the call itself.

Findings of the Ombudsman

In light of the investigation carried out, the Ombudsman found that Suomen Yritysrekisteri had violated Articles 12(1), 12(2), 12(6), and 15(3) of the GDPR.

Notably, the Ombudsman explained that the summary provided by Suomen Yritysrekisteri cannot be considered a 'copy' of personal data in accordance with the GDPR, as this would correspond to the original content of the call itself. Also, the Ombudsman found that the respondent company did not facilitate the submission of the data access requests.

Outcomes

As a result, the Sanctions Board imposed a fine of €23,000 on Suomen Yritysrekisteri for the aforementioned reasons. Lastly, the Ombudsman stated that an appeal may be lodged against the decision with an administrative court.

You can read the press release here and the decision here, both only available in Finnish.