Administrative fine imposed on business directory operator for infringements of the right to obtain call recordings
The Office of the Data Protection Ombudsman's Sanctions Board has imposed an administrative fine of 23,000 euros on Suomen Yritysrekisteri, a business directory operator. The company had not provided telephone call recordings to individuals who had asked for them in accordance with data protection legislation. Furthermore, the company had failed to comply with the Deputy Data Protection Ombudsman's prior order to bring their operations into compliance with the law.
The Office of the Data Protection Ombudsman investigated the operations of Suomen Yritysrekisteri based on a number of complaints made in 2019–2022. Several self-employed persons had complained to the Office of the Data Protection Ombudsman that they had received an invoice after a sales call from Suomen Yritysrekisteri, so they had asked for a recording of the call. The company delivered a written summary of the call to some of the self-employed persons but, according to the complainants, these summaries did not correspond to the contents of the sales call.
The Data Protection Ombudsman notes that a summary delivered by the company cannot be considered to constitute a copy corresponding to the contents of the original call as required by the General Data Protection Regulation. The controller must fulfil the data subject's right of access by delivering a copy of the personal data being processed by it. The copy can be provided in a format different from the original, as long as it is complete and contains all of the requested information.
The Data Protection Ombudsman points out that the purpose of the right of access is to give the individual the opportunity to verify which data the controller is processing. ”The right of access is especially necessary so that the individual can exercise their other rights under the GDPR if necessary”, says Data Protection Ombudsman Anu Talus.
The Sanctions Board finds that the company's established practice has caused it to unlawfully neglect the data subject's right of access with regard to call recordings. Already in 2022, the Data Protection Ombudsman instructed the company that a copy delivered pursuant to the right of access must correspond to the contents of the call recording.
The processing of personal data is an essential component of the company's core business, since the business directory lists the personal data of private entrepreneurs, among other things.
The company failed to bring its operations into compliance with regard to the provision of call recordings
The administrative fine was also based on the fact that the company had neglected to comply with the Deputy Data Protection Ombudsman’s prior order. In March 2021, the Deputy Data Protection Ombudsman noted that offering the opportunity to listen to the call cannot be the sole way of fulfilling the right of access and ordered the company to rectify its practices. Despite the order, the company failed to implement another method of delivering call recordings in accordance with the GDPR.
Neither did the company inform the Office of the Data Protection Ombudsman of measures taken due to the Deputy Data Protection Ombudsman's order. The Sanctions Board finds the company's violations to be intentional and extensive in scope.
Suomen Yritysrekisteri is an auxiliary trade name of Suomen Avainsanat Oy.
The decision is not final and can be appealed in the Administrative Court.
Decisions of the Data Protection Ombudsman and Sanctions Board in Finnish
Further information:
Data Protection Ombudsman Anu Talus, anu.talus(at)om.fi, tel. +358 29 566 6766
The decision-making of the sanctions board and legal protection of controllers are provided for in the Finnish Data Protection Act. The sanctions board is made up of the Data Protection Ombudsman and two Deputy Data Protection Ombudsmen, and it has the power to impose administrative fines for violations of data protection legislation. The maximum amount of the administrative fine is four percent of the company’s turnover or EUR 20 million.