Annual Report of the Office of the Data Protection Ombudsman 2023: data protection work in a changing digital world
The Office of the Data Protection Ombudsman has published its Annual Report for 2023. The report describes the most important data protection events of the year, the main decisions and supervisory activities in the different areas of activity, and the key performance indicators. The year was marked by legislative reforms, active European cooperation, a growing caseload and the reorganisation of the office.
Supervision, enhanced policies and children’s data protection
At the heart of the activity was the authority’s supervisory work. During the year, the Office issued important decisions on matters such as the retention periods of loyal customer data, the exercise of the right to access one's own data and the adequacy of safeguards. In total, three companies were fined for data protection violations. The violations concerned non-compliance with a previous order of the Data Protection Ombudsman, shortcomings in the provision of call recordings and failure to respect the customer's right of access. The fines ranged from EUR 1,600 to EUR 440,000.
Currently, no administrative fine can be imposed on public sector operators in Finland. “The extension of administrative fines to the public sector is included in the current Government Programme. This would be in line with other Nordic countries,” says Data Protection Ombudsman Anu Talus.
Participation in the cooperation of European data protection authorities is one of the key tasks of the Office. During the year, the office played an active role in the work of the European Data Protection Board and in pan-European decision-making.
In addition, several opinions were issued during the year highlighting the importance of data protection in legislative projects. A total of 11 audits were carried out, with a focus on internal security authorities. Based on the findings, guidance and recommendations were given to operators. The Office also participated in a joint exercise with European data protection authorities to examine the role of data protection officers in organisations.
One of the key priorities for the year was child data protection. In the joint project GDPR4CHLDRN - Ensuring data protection in hobbies, the Office of the Data Protection Ombudsman and TIEKE Finnish Information Society Development Centre continued to develop data protection materials to support leisure activity organisers, children and young people and their parents.
During the year, the administrative courts issued several decisions confirming the line taken by the Office of the Data Protection Ombudsman. Among other things, many of the administrative fine decisions adopted in previous years remained in force.
Number of cases starts to grow again
The number of cases brought before the Office of the Data Protection Ombudsman showed a clear increase from the steady figures of previous years. In 2023, 13,180 cases were opened, an increase of about 2,000 cases compared to the previous year. A record number of cases were also resolved, 13,060 in total.
Notifications of personal data breaches are the largest group of cases handled by the. There were almost 6,900 data breach notifications during the year, which was approximately 1,400 more than in the previous year. The growing number is partly explained by the development of digitalisation and the increased awareness of organisations of their reporting obligations. The majority of notifications come from regulated sectors such as social services, healthcare, the financial sector and telecoms. The number of notifications in Finland is high, but not exceptionally so compared to peer European countries.
The number of cross-border cases between EU countries is also on the rise. In the coming years, the tasks of the Office of the Data Protection Ombudsman are expected to increase, for example with new responsibilities arising from EU digital and data legislation.
“The debate on artificial intelligence in particular continued to be intense and is being even more so in 2024. It is important to ensure that cooperation between authorities in the enforcement of the EU's AI Act is smooth at both national and European level,” says Talus.
Reforms streamline operations
The organisational structure of the Office of the Data Protection Ombudsman underwent reform in spring 2023. Reform brought with it changes to the structures of the services and responsibilities of the ombudsmen.
Efficiency was improved by developing the offices systems, processes and services. The new case management system will streamline the handling of cases and promote knowledge-based management. The migration of the notification forms to a Security Forms service will make it easier for organisations to document breaches and comply with the obligation to report them.
Read the Annual Report
A summary of the Annual Report is published electronically on our website in English: Annual Report of the Data Protection Ombudsman 2023 (PDF)
We have compiled the main points of the Annual Report on our website: Annual Report 2023
Further information:
Anu Talus, Data Protection Ombudsman, anu.talus(at)om.fi, tel. +358 29 566 6766
Communications of the Office of the Data Protection Ombudsman: viestinta.tietosuoja(at)om.fi