Annual report 2024 of the Office of the Data Protection Ombudsman: Promoting data protection in the transformation of regulations and the digital society
The Office of the Data Protection Ombudsman has published a report on its activities in 2024. The annual report describes the year's most important data protection events, decisions and supervision measures in different sectors and presents the key figures for the Office's operations. The year was characterised by legislative amendments and the new duties they brought, debate on AI and cooperation between European data protection authorities on current data protection issues.
A diverse year in the supervision of data protection legislation
Issues concerning personal data storage periods, people’s data protection rights and the secure processing of data were the main themes in Data Protection Ombudsman's supervisory work during the year. Three companies were ordered to pay administrative fines for data protection violations. The administrative fines ranged from 856,000 to 2.4 million euros.
Under current legislation, administrative fines for data protection violations cannot be imposed on public sector entities. The legislative project assessing the extension of administrative fines to the public sector continued in 2024.
A clear increase in the number of a data protection offence cases was observed during the year. The number of statements issued by the Data Protection Ombudsman to support the consideration of charges increased significantly, from 54 in the previous year to 110 in 2024. Most of the statements concerned so called snooping in which the data of another person had been viewed without justification.
Number of cases remains high, growth of data breach notifications continues
The number of cases instituted with the Office of the Data Protection Ombudsman has increased year after year. More than 13,280 cases were instituted in 2024. A record number of cases – approximately 13,290 in total – were also processed.
Personal data breach notifications have been the Office's largest category of cases for several years now. They already account for more than half of all cases. During the year, organisations reported more than 7,150 data breaches to the Data Protection Ombudsman, which was approximately 250 more than in the previous year. More than 30,000 data breaches have been reported since 2018.
In recent years, the Office of the Data Protection Ombudsman has received a number of new duties as a result of legislative reforms, and the Office's duties are expected to keep increasing. The reform of the EU's digital and data regulation package in particular will bring new duties to data protection authorities.
“The accelerating digitalisation of society, rapid technological development and the manifold growth in digital regulation also mean significant increases to the duties of the supervisory authority. It is extremely important to ensure that the data protection authority has the resources to handle the expanding scope of its duties”, says Anu Talus, Data Protection Ombudsman.
A common direction in European cooperation
During the year, the Office of the Data Protection Ombudsman was actively involved in the work of the European Data Protection Board and in joint European decision-making. In the EDPB, European data protection authorities jointly develop guidance and policies to clarify and harmonise rules in an evolving data protection environment.
The EDPB issued significant opinions and instructions during the year, including on the use of personal data in the development of AI models, legitimate interest as a basis for processing personal data, and the “consent or pay” practices of large online platforms.
The Board also seeks to support small companies in complying with data protection requirements. The guide for small and medium-sized enterprises prepared by the EDPB was also published in Finnish and Swedish in the autumn of 2024.
Read the Annual report 2024 (pdf)
More information:
Communications unit of the Office of the Data Protection Ombudsman: viestinta.tietosuoja(at)om.fi
The Office of the Data Protection Ombudsman is an independent authority that supervises compliance with legislation on the processing of personal data. The office employs approximately 60 experts.